Upgrades and rollback

The edge upgrade path is intentionally more cautious than the client path. It can back up the current binary, DB, and env file, install a new daemon, restart, verify health, and roll back on failure.

Upgrade the edge with local Go

Run on the edge:

cd ~/tunneled
sudo ./scripts/upgrade-edge.sh --build

Upgrade the edge with Docker

Run on the edge:

cd ~/tunneled
sudo ./scripts/upgrade-edge.sh --docker-build --goos linux --goarch amd64

Useful flags:

Flag	Meaning
--binary <path>	Install a prebuilt mytunneld binary.
--service <name>	systemd service name, default mytunneld.
--build	Build with local Go before install.
--docker-build	Build with Docker before install.
--docker-image <image>	Docker image for build, default golang:1.25.
--goos <os>	Target GOOS, default linux for edge.
--goarch <arch>	Target GOARCH, default inferred from host.
--upgrade-backup-dir <dir>	Backup root, default /var/backups/mytunneld.
--no-backup	Skip backup, advanced only.
--skip-restart	Install binary but skip restart and verification.

What edge upgrade verifies

After installing the new binary, upgrade-edge.sh verifies:

• systemctl restart <service> succeeds.
• The service is active.
• Caddy Admin API responds at the configured URL.
• mytunneld ctl health --json returns status: ok.

If verification fails and backup is enabled, the script restores the previous binary and DB snapshot, then restarts the service.

Find backups

Default backup root:

/var/backups/mytunneld

Each upgrade creates a timestamped directory:

/var/backups/mytunneld/upgrade-YYYYMMDDTHHMMSSZ/

It can contain:

• mytunneld.prev
• leases.db.prev
• mytunneld.env.prev

Upgrade the client

Local Go:

cd ~/tunneled
./scripts/upgrade-local.sh --build

Docker:

cd ~/tunneled
./scripts/upgrade-local.sh --docker-build --goos darwin --goarch arm64

Prebuilt binary:

./scripts/upgrade-local.sh --binary ./bin/mytunnel

Roll back manually

If the automatic rollback could not run, restore from the backup directory.

sudo install -m 0755 /var/backups/mytunneld/upgrade-YYYYMMDDTHHMMSSZ/mytunneld.prev /usr/local/bin/mytunneld
sudo cp -f /var/backups/mytunneld/upgrade-YYYYMMDDTHHMMSSZ/leases.db.prev /var/lib/mytunneld/leases.db
sudo systemctl restart mytunneld
mytunneld ctl health --json

Only restore the DB snapshot if you accept losing lease changes made after that backup.

Uninstall and recovery

Dry-run edge uninstall:

sudo ./scripts/uninstall-edge.sh --dry-run

Remove edge service, binary, and config while preserving data:

sudo ./scripts/uninstall-edge.sh

Remove data too:

sudo ./scripts/uninstall-edge.sh --purge-data

Client uninstall dry-run:

./scripts/uninstall-local.sh --dry-run

Client uninstall:

./scripts/uninstall-local.sh

Release-quality verification

Before cutting a public release:

go test -race ./...
go test ./... -count=1
go run golang.org/x/vuln/cmd/govulncheck@v1.1.4 ./...
make build
make release-client
make checksums

If local Go or shellcheck is unavailable:

make verify-docker