Start

Updating & security

Keep the panel current without touching your sites, back up its own state, and run through the security checklist once you're live.

Updating the panel

From the panel: Settings → StackPanel version shows the running commit hash and date. Check for updates fetches from git and lists new commits; Update now pulls them and rebuilds the container.

The update runs on the host as a transient systemd unit (sm-update), so it carries on while the panel's own container is replaced. The page follows the log, reconnects when the new container is up, and reloads. The panel is unavailable for a minute or two; sites, workers and cron jobs keep running. The log is /var/log/server-manager-update.log (also under Logs → System → Panel updates).

This needs /opt/server-manager to be a git clone of git@github.com:SCC-Pro/server-manager.git that root can pull from (the deploy key from the quick start). Set SM_INSTALL_DIR in .env if you installed somewhere else.

By hand:

$ cd /opt/server-manager
$ bash scripts/update.sh      # = git pull --ff-only && docker compose up -d --build

Migrations run automatically when the container starts. The panel's own state (SQLite database, generated app key) lives in the sm-data Docker volume and survives rebuilds. Projects, nginx configs, certificates, cron files and Supervisor programs live on the host and aren't touched by updates.

Backing up the panel's state

Project backups are handled by Backups. To keep a copy of the panel's own database and key as well:

$ docker run --rm -v server-manager_sm-data:/data -v "$PWD":/backup alpine \
    tar czf /backup/sm-data-$(date +%F).tgz -C /data .

Security checklist

  • Strong admin password in .env (or a bcrypt hash), plus two-factor authentication. Sign-in is rate-limited to 5 attempts per minute per IP.
  • Give each person their own login (Users page) rather than sharing the main administrator account. Panel users must use 2FA, can be disabled instantly, and their manual deploys are attributed to them.
  • Panel domain with HTTPS, then SM_BIND=127.0.0.1 and close the panel port in UFW. See Panel domain & HTTPS.
  • Keep .env at chmod 600 and out of git.
  • Delete /root/server-manager-credentials.txt after noting the password.
  • MySQL listens on 127.0.0.1 only; database users are created for localhost/127.0.0.1, never remote.
  • Deploy keys are read-only and per project. The file manager can't see .ssh folders.
  • The container is privileged with access to the host: treat panel access like root SSH access.