Backups and upgrades

What to back up

FireSight keeps all of its state in its database. The app container holds nothing you need to keep. Back up two things, and keep them together:

What	Why
The PostgreSQL database (the `pgdata` Docker volume in the standard `docker-compose.yml`)	Every request, approval, deployment record, connection, setting, license, offline snapshot, FortiGate configuration backup and audit event.
The `.env` file	Above all `FIRESIGHT_SECRET_KEY`. API tokens, the LDAP service password, the OpenID Connect client secret, the SMTP password, webhook URLs, offline snapshot files and FortiGate configuration backups are encrypted with it. A database restored without the same key can't decrypt them.

Warning

The database backup contains encrypted secrets and firewall configurations. Store it as securely as the firewalls themselves.

FireSight doesn't include its own backup or restore command. Use your organisation's normal PostgreSQL backup method for the db service. For a procedure for your environment, contact FireSight support.

Upgrade

FireSight upgrades its database schema automatically when it starts, so an upgrade is a restart on the new release.

To upgrade:

Read the release notes for the new version.
Back up the database and .env (see above).
Put the new release files in place, keeping your .env.
Rebuild and restart:
```
docker compose up -d --build
```
Check the version under Settings, System, or at /api/health.

To see which schema revision the database is at, or its history:

docker compose exec app python -m app.migrate current
docker compose exec app python -m app.migrate history

A database created by an early FireSight build, before schema migrations, is brought up to date and stamped on its first start with a newer release.

Moving to new hardware

A FireSight license is tied to the system it was issued for. If you restore FireSight onto a new server, the license keeps working for 30 days while you ask for a re-host. See Licensing.