Updating and uninstalling the agent
How the agent updates itself safely, how to control or do it by hand, and how to remove it.
Automatic updates
On a server, the agent updates itself:
- Signed. Ed25519 signature checked against a built-in key. Unsigned or older releases are refused.
- Between tasks. Never during a backup, Proof or Mark.
- Checked. Size and SHA-256 must match the signed manifest.
- Self-tested. It must load the config, find pgBackRest, reach Rowsafe and connect to every database before switching.
- On probation. No tasks until it has run a minute and reached Rowsafe. No contact within 10 minutes, or 3 failed starts, rolls it back.
A failed version isn't retried for 24 hours. rowsafe hosts list shows each host's version and last result (staged, switched, confirmed, rolled_back or failed).
In Docker, the agent never updates itself: change the image tag.
Control updates
| To | Run |
|---|---|
| Move a host to another channel | rowsafe hosts channel db-1 beta |
| Keep a host on one version | rowsafe hosts pin db-1 0.4.2 |
| Follow the channel again | rowsafe hosts unpin db-1 |
| Turn off automatic updates | Set ROWSAFE_AUTO_UPDATE='false' in /etc/rowsafe/agent.env, then sudo systemctl restart rowsafe-agent |
| Upgrade or reinstall by hand | Run the installer again (below) |
A pin never downgrades: the agent refuses older versions.
Upgrade by hand
Re-running the installer is safe: it changes only what differs, keeps your config, and waits for running backups and Proofs:
curl -fsSL https://rowsafe.sh | sudo shOne exact version:
curl -fsSL https://rowsafe.sh | sudo ROWSAFE_VERSION=0.4.2 shGoing back to an older version also needs ROWSAFE_ALLOW_DOWNGRADE=1. See the installer options.
Change the configuration
Edit /etc/rowsafe/agent.env (sudoedit), then re-run the installer (it self-tests) or restart the agent:
sudo systemctl restart rowsafe-agentAfter rotating bucket keys, restart the agent, then click Check again on each database's Health page (or rowsafe verify app). This rewrites pgBackRest's config and proves the new keys work.
Never change the passphrase, bucket or path of a repository with backups
pgBackRest can't re-encrypt an existing repository: old backups would become unreadable, or new WAL would go elsewhere. To move to a new bucket, adopt the database afresh, and keep the old bucket settings and passphrase in your secret manager until its old backups expire.
Uninstall
Uninstalling doesn't touch PostgreSQL, and WAL archiving keeps working (it only needs pgBackRest and /etc/rowsafe/pgbackrest).
curl -fsSL https://rowsafe.sh | sudo sh -s -- --uninstallIt keeps the config, state, logs, pgBackRest and your backups.
To also delete config, state and logs, first turn off WAL archiving (Rollback), then:
curl -fsSL https://rowsafe.sh | sudo sh -s -- --uninstall --purge--purge refuses while archive_command still points at /etc/rowsafe/pgbackrest: every archive attempt would fail and pg_wal would fill the disk. It only checks the usual Debian and Ubuntu config paths. If your data directory is elsewhere, check archive_command yourself.
Then remove the server from Rowsafe:
rowsafe remove app --keep-archiving # for each database on it
rowsafe hosts remove db-1In Docker, turn off archiving first (the same ALTER SYSTEM commands), then remove the rowsafe-agent service. Otherwise WAL keeps piling up in the spool volume with nothing pushing it.