v0.24.9

docs/MIGRATION.md

@@ -199,10 +199,10 @@ configuration publication. See CACHE_DIAGNOSTICS.md for explaining BYPASS.
 
 ACME/RFC2136 is optional and adds external Python/Certbot/plugin requirements.
 No DNS update or CA request happens simply by upgrading. Issuance is explicit,
-staging-first and does not activate a certificate without import. Existing
-`dev.sh backup` does not include the private `certs/acme` account/TSIG profiles;
-back those up separately when issuance is idle. No automatic renewal is included.
-See ACME_RFC2136.md for limitations and restoration responsibilities.
+staging-first and does not activate a certificate without import. Current encrypted full backup includes the durable ACME profile/account state and
+Secret Store material required for DNS-provider renewal; the historical `dev.sh backup`
+helper does not. Use `rust-proxy backup create` for current installations. Automatic
+renewal behavior is documented in RENEWAL.md.
 
 
 ## Reported auth module compilation failure
@@ -230,16 +230,20 @@ source-tree update is preferable to extracting individual files over a checkout.
 
 ## Recommended source update
 
-Extract the new archive beside, not inside, the installed project. First back up
-the existing database using the new backup script. The destination must not exist:
+Extract the new archive beside, not inside, the installed project. On installations
+that provide the current encrypted backup command, stop RustProxy and create the
+backup outside the data directory before replacing source files:
 
 ```bash
+rust-proxy --data-dir /home/mg/RustProxy/data backup create \
+  --output /home/mg/RustProxy-backup-before-upgrade.rpb
 unzip RustProxy-0.4.0.zip -d /home/mg/rustproxy-040-staging
 cd /home/mg/rustproxy-040-staging/RustProxy
-python3 scripts/backup.py --data-dir /home/mg/RustProxy/data \
-  /home/mg/RustProxy-backup-before-0.4.0
 ```
 
+`scripts/backup.py` is a legacy release-test helper and is not a complete Secret
+Store backup. For current backup/restore behavior see `SECRET_STORE_BACKUP.md`.
+
 A missing database means there is no database to back up. Do not initialize an empty
 replacement accidentally. For data stored elsewhere, use the actual directory.
 
@@ -283,25 +287,15 @@ never overwrite an existing configuration, including an empty existing one.
 
 ## Backup contents and restore
 
-`./dev.sh backup NEW_DIRECTORY` uses SQLite's online backup API, so committed WAL
-content is included. The result contains a private `config.sqlite3`, `backup.json`
-with hashes/revision metadata and any configured/default certificate files under
-`certs/`. Unreferenced staged certificate files are not included. Do not rotate or
-manually replace certificate files while taking a backup. This is a consistent
-SQLite snapshot plus file copies, not one cross-filesystem transaction.
+Current RustProxy releases use the password-encrypted full-backup format documented
+in `SECRET_STORE_BACKUP.md`. The supported interface is `rust-proxy backup create`
+and CLI-only `rust-proxy backup restore`; it includes the encrypted Secret Store,
+key material required to recover it, certificates and other durable application
+state while excluding cache, logs and runtime files.
 
-Backups contain credential hashes, session records and private keys. Keep them
-private, encrypted at rest as appropriate, and outside public web directories.
-They do not contain `.env`, source edits or a generated dependency lockfile; preserve
-those separately. Existing backup destinations and certificate symlinks are refused.
-
-To restore, stop the server, verify backup hashes and keep the current data directory
-as a separate recovery copy. Restore into a **new private directory**, including
-`config.sqlite3` and `certs/` together, then point `RUST_PROXY_DATA_DIR` to it.
-Use directory mode 700 and file mode 600. Do not copy stale `-wal` or `-shm` files
-from another database beside the restored snapshot. Start the matching version and
-run `./dev.sh admin logout-all` or reset the password to revoke restored sessions.
-Verify routes, TLS identities and administration before resuming traffic.
+The historical `./dev.sh backup` / `scripts/backup.py` snapshot helper described by
+older release notes is not sufficient after Secret Store migration and is retained
+only for offline compatibility/release tests.
 
 ## Downgrade