Documentation
Keep it running
Backups you can read, an upgrade that is one command, and what to do on the day something is wrong.
Backups
./backup.sh # backups/forinda-cms-<timestamp>.sql.gz
./backup.sh restore <file> # asks before replacing anythingA plain pg_dump that any Postgres can read — the spec, its entire change history, and your content. No account, no export queue, no format only this software understands.
Restoring stops the app first so nothing writes mid-restore, and asks you to type the database name. It is the one command here that can lose data, and it should be hard to run by accident.
Uploaded media lives on disk rather than in Postgres, and the backup covers both — a backup that restores the site without its pictures is one you find out about at the worst moment.
There is a second, different export: fcms pull —content writes the spec and every row as readable files you can commit to git, edit by hand, and send back with fcms apply —content. It is not a replacement for the dump above — it holds no history and no media — but it is the copy you can actually read, diff and review.
Upgrading
docker compose pull && docker compose up -dMigrations run on boot and are idempotent and resumable, so an interrupted upgrade is re-runnable. Take a backup first anyway — it costs one command.
When something is wrong
| Nobody can sign in | Usually SECURE_COOKIES=true without working HTTPS: the browser is
told to send the session cookie only over TLS, so it never arrives. |
| Postgres will not start after an upgrade | Check the data volume is mounted at /var/lib/postgresql. Postgres 18
images refuse to start on a volume laid out for older ones. |
| A change did something unexpected | Undo it from History. Then read the entry — it says who made it and through which surface. |
| The assistant is off | No ANTHROPIC_API_KEY on the install. Everything else keeps working;
that is deliberate. |
| The site is up but a page 404s | Check the entry is published — a draft is saved but not served — and that the address is what you think. A moved page redirects from its old address automatically; a page never published has no address at all. |
If a token or a laptop goes missing
Sessions in the dashboard lists everywhere you are signed in — browsers, and any terminal or agent that ran fcms login — with what each is and when it was last used. Revoke one, or sign out everywhere else in a single click. Revoking takes effect on the next request.
Sign-in is rate limited: ten failures in fifteen minutes, counted per account and per address, then a short wait. The counter clears the moment a correct password is used, so mistyping yours a few times costs nothing.
Moving off
Take a dump, stand the compose file up somewhere else, restore. That is the whole procedure, and it works the same whether you are moving between your own machines or away from anything we ever host.