Upgrading and migrating

Online upgrade (recommended)

The current version number is shown in the bottom-left corner of the admin panel. Click it to check for and apply updates. Nothing needs to be done on the server.

Back up your database first. In aaPanel it is one click under Database → Backup, takes seconds, and will save you if anything goes wrong.

Docker users upgrade the same way — the program files live in the data volume, so there is no need to change the image.

Manual upgrade

Only for when the online upgrade fails. Start from your current version and apply each release in order — you cannot skip versions.

Each upgrade package contains:

Item	What to do
file/ directory	Copy its contents into the site root, overwriting
update.sql	Only present when the database changes — see below

For update.sql:

1. Open it and replace every __PREFIX__ with your table prefix (acg_ by default)
2. Run the SQL in phpMyAdmin or any database client

When you have applied everything, set version in config/app.php to the version you upgraded to.

Manual upgrades are error-prone. Use the online upgrade whenever it works.

Upgrading to 3.8.2

3.8.2 brings two account security changes:

• Integration IP whitelist. Every member can register server IPs; once registered, the integration API only accepts balance orders from those IPs. Accounts that register nothing behave as they did in 3.8.1. In 3.8.1, an account with fund operation verification on could not spend its balance through the integration API at all; from 3.8.2 it can, once it has registered its server IPs. The default theme adds an Integration whitelist page to the user centre (just left of Security log); other themes show the whitelist on the Two-step verification page. The new database table is created automatically during the upgrade; there is no SQL to run by hand. If the site sits behind a CDN or reverse proxy, set IP detection mode and Trusted proxy IPs under Site settings → Security first, otherwise members can only whitelist the CDN's IPs. Details in integration IP whitelist.
• Member security logs in the admin panel are for the main admin only. The Security log button in the member list now opens only for the main admin account (the one created during installation); Super Administrator, Day Shift and Night Shift accounts get a no-permission message.

Upgrading to 3.8.1

3.8.1 tightens account and sign-in security. After upgrading you will notice the following — all of it is expected:

• Every member has to log in once more. Member sign-in credentials were rebuilt for security, so existing member sessions end.
• Passwords are stored with a stronger hash. Member and admin passwords move to a stronger, deliberately slower hash that is much harder to brute-force. Each account is converted automatically the next time it logs in with its password — nothing for you to do. When an admin account is converted, its admin sessions on other devices end once; just log in again.
• The admin idle lock screen is on by default. After 15 minutes without activity the admin panel locks itself. Change the timeout under Site settings → Security → Admin Idle Lock, or set it to 0 to turn it off. Upgrading does not log admins out.
• Database changes are applied automatically. The online upgrade takes care of them; there is no SQL to run by hand.

Do not roll the program back to an older version after upgrading to 3.8.1. Accounts whose passwords have already been converted can no longer log in with their password on an older version.

Details are in account & sign-in security.

Migrating to another server

1. Archive the source — the whole site directory
2. Export the database — phpMyAdmin or mysqldump
3. Set up the new server following the aaPanel guide, matching PHP version and extensions
4. Extract the source into the new site root and import the database
5. Edit config/database.php with the new host, user and password
6. Reconfigure URL rewriting and directory permissions

If it does not come up, check in this order:

Check	Why
config/database.php	Still pointing at the old database
Redis	If the old site stored sessions in Redis, install it here too, or switch PHP's session storage back to files
PHP extensions	Do not forget bcmath (aaPanel includes it; check it yourself on a manual setup)
Permissions	config, runtime, kernel/Install, assets/cache must be writable
URL rewriting	Has to be configured again on the new server

Swapping the Docker image

docker pull ghcr.io/lizhipay/acg-faka:latest
docker stop faka && docker rm faka
docker run -d --name faka -p 80:80 -v acg_data:/data --restart unless-stopped ghcr.io/lizhipay/acg-faka:latest

As long as the acg_data volume name is unchanged, your data, configuration and installed plugins are all still there.

Something broke after upgrading

Read runtime.log in the site root first — the real cause is almost always in there.