# Upgrading to 3.3

This guide is written against Noust 3.2.1. A server older than 3.2 goes through
[UPGRADING-3.2.md](/docs/releases/upgrading-3.2/) first; the packages do the steps in one upgrade.

The short version: 3.3 changes what Noust sees and says about databases, not what runs. The store
schema does not change (it stays at version 13), no unit, site or application is rewritten, and
the upgrade is the usual package update. A fleet upgrades as before: the nodes with
`noust fleet run noust_update` (a canary first), then the central.

## What you will notice

- **More databases.** The databases of Docker containers appear in the Databases area and in
  `noust db list`, under keys like `postgresql@shop.db`. Seeing them changes nothing: they are not
  tracked, linked or backed up by Noust until you ask (`noust db adopt`, a backup policy, a link).
- **Engines that refused Noust now say so.** If a host engine's listing used to be empty, look
  again: it probably says that the engine does not let Noust in, with its own message. For
  MySQL/MariaDB and Redis, store the account from the console or with
  `noust db config --engine mysql --user root --password`.
- **Detected links.** Applications whose `.env` names a database appear beside it as detected.
  Nothing is linked until you record one ("Record the link" in the console). `noust db adopt` does
  not record them. A recorded detected link carries no account, so rotating that account's
  password does not rewrite the application's `.env`; link it with `noust db link` if Noust
  should.
- **Exposure.** Ports Docker publishes that the `DOCKER-USER` chain already refuses on the public
  interface stop being reported as open. `noust db exposure --json` still lists them, marked
  `"firewalled": true`; its exit status counts only the open ones.
- **Compose stacks started by hand** show as running outside Noust instead of stopped.

## What changes on its own

- The monitor's database metrics sample the containers too, once a minute, through
  `docker exec` (one short read-only query per instance).
- `noust db list` exits 1 when an engine could not be read, so a script notices instead of
  reading an empty list.
- Under the `ens-medium` profile, a database setting that would make an engine listen beyond the
  loopback is refused.

## Rolling back

Downgrading the package to 3.2.1 is enough: the store is the same. Links recorded from detected
uses and settings files written by 3.3 stay (`/etc/postgresql/*/main/conf.d/90-noust.conf`,
`99-noust.cnf`, `/etc/redis/noust.conf`); 3.2.1 ignores the links' origin and the engines keep
reading the files.