Backups and updates

Keeping a self-hosted store safe and current.

Only for self-hosted stores. If we host yours, backups, patching and updates are ours to worry about.

Backups

Two things have to be backed up, and they are useless apart:

What	Contains
The database	Products, orders, customers, settings — everything you would cry about
`storage/`	Product images and uploads

# Database
mysqldump -u gosell -p --single-transaction gosell \
  | gzip > /backups/gosell-$(date +%F).sql.gz

# Uploads
tar czf /backups/storage-$(date +%F).tar.gz -C /var/www/gosell storage

Run both nightly from cron:

0 2 * * * /usr/local/bin/gosell-backup.sh

A backup you have never restored is not a backup. Restore one onto a spare server, at least once, before you need to. Most backup scripts that "work" turn out to produce empty files, miss the uploads, or write to a disk that was full — and you find out on the worst possible day.

Keep a copy off the server

A backup on the same machine protects you from a mistake, not from losing the machine. Copy them somewhere else — object storage, another provider, anywhere that fails independently.

Restoring

gunzip < /backups/gosell-2026-08-26.sql.gz | mysql -u gosell -p gosell
tar xzf /backups/storage-2026-08-26.tar.gz -C /var/www/gosell

Then check file ownership, because a restore as root will have changed it:

sudo chown -R www-data:www-data /var/www/gosell/storage

Updating the platform

We publish releases and tell you what changed. Applying them is your call and your responsibility — nobody does it for you on a self-hosted store.

Back up the database and storage/. Not optional.
Read what changed.
Put the new files in place, keeping your .env and storage/.
Run php command migrate.
Check the storefront and place a test order.

Do not update during your busiest hours, and never on a Friday evening. If something breaks you want to be awake, unhurried, and able to reach us.

Test somewhere else first, if you can

A copy of the store on a second server, updated first, turns a risky change into a boring one. Worth the extra machine once you are taking real money.

Keeping the server safe

Apply OS security updates. unattended-upgrades handles most of it.
Disable password SSH and use keys.
Firewall everything except 80, 443 and SSH. MySQL should not be reachable from the internet at all.
Do not reuse the database password anywhere else.
Check .env is not web-reachable after every change to the web server config.

What to watch

Check	How often	Why
Disk space	Weekly	Images and backups fill disks quietly; a full disk stops orders
`storage/logs/schedule.log` is growing	Weekly	If cron dies, background work stops with no error
Backups exist and are not empty	Weekly	Silent failure is the normal failure
HTTPS certificate valid	It renews itself — but check	An expired certificate closes the shop
A test order completes	Monthly	Catches an integration whose token quietly expired

If you get stuck

We will help you deploy and hand over, and we would rather answer a question than have you guess. Day-to-day operation of your own server is yours — but ask anyway; we would rather you did.

Still stuck? Message us on WhatsApp — we would rather answer than have you guess.