Product guide

Platform Updates & Lifecycle Management

A comprehensive guide to managing Moftgate server platform updates: cloud automated delivery, air-gapped offline package deployment, multi-stage migration pipeline, real-time terminal telemetry, and automated zero-loss rollback mechanisms.

Overview & Platform Architecture#

Moftgate DLP & UEM provides an enterprise-grade, resilient platform lifecycle engine designed for both cloud-connected and air-gapped on-premises infrastructures. The platform update subsystem guarantees atomic migrations, cryptographic integrity verification, automatic pre-flight snapshots, and instant zero-loss rollbacks.

Zero-Downtime Philosophy

Server updates are executed with atomic container and worker restarts. Client endpoint agents continue monitoring, intercepting DLP violations, and buffering telemetry in local SQLite databases without losing a single log entry.

System Stack Health & Pre-flight Diagnostics#

Before applying any platform update, the orchestrator evaluates the operational health of all underlying infrastructure dependencies to eliminate update risks:

Stack Component	Technology	Pre-flight Validation Role
Platform Core Engine	Laravel 13 & Octane / Rust Zenith Gateway	Displays active server release version, environment mode (production/staging), and runtime stability.
PostgreSQL Database	PostgreSQL 15+ relational persistence layer	Validates active PDO connection status, schema consistency, and migration lock readiness.
Redis In-Memory Engine	High-speed cache & queue message broker	Verifies Redis ping latency, job queue worker health, and real-time socket pub/sub state.
Container Engine	Docker / Containerd runtime interface	Checks background container status, isolation boundaries, and auxiliary microservice uptime.
Storage Subsystem	Disk free space & snapshot allocation	Guarantees sufficient disk capacity for pre-flight snapshots, package extraction, and rollbacks.

Cloud Automated Updates (1-Click Delivery)#

For connected deployments, administrators can query the Moftgate Cloud Registry to retrieve official updates, cryptographic signatures, and detailed release changelogs:

1
Open General Settings > Platform Update
Navigate to Settings in the main navigation menu and select the Platform Update tab under the System group.
2
Check for Updates
Click the "Check for Updates" button to query the Moftgate Cloud Registry using your cryptographically verified license and hardware Machine ID.
3
Review Release Notes & Version Diff
Inspect the incoming version number, release date, package size, security patches, and changelog highlights directly within the modal.
4
Initiate 1-Click Update
Click "Install Platform Update". A safety confirmation dialog will outline the automated pre-flight snapshot and migration sequence before execution.

Offline & Airgap Package Deployment (.mpkg / .tar.gz)#

In isolated military, financial, or high-security networks, updates are supplied as cryptographically sealed `.mpkg` or `.tar.gz` archives containing all database migrations, frontend bundles, and service binaries:

1
Acquire the Verified Update Bundle
Download the signed offline update package (.mpkg, .tar.gz, or .tgz) from the Moftgate Customer Hub or authorized distribution portal.
2
Drag and Drop or Select Bundle
Drop the package file into the Offline Package Deployment zone on the Platform Update page.
3
Cryptographic Hash & Manifest Validation
The server computes the SHA-256 checksum and unpacks the internal manifest.json to verify target version compatibility and integrity.
4
Staging & Immediate Execution
The package is recorded in the platform update catalog. You can enable/disable its availability or start the multi-stage deployment pipeline immediately.

Package Manifest Structure

Every offline bundle contains a root manifest.json defining target_version, SHA-256 signatures, minimum platform version requirements, schema migration scripts, and post-install hooks.

Package Staging & Activation Control#

Uploaded offline packages feature an individual active toggle switch. This allows staging upcoming platform versions ahead of scheduled maintenance windows without immediately exposing them to operators or trigger mechanisms.

Multi-Stage Automated Execution Pipeline#

The platform update execution orchestrator runs a sequential 6-stage async state machine with real-time log streaming and progress tracking:

Pipeline Stage	Progress	Execution Actions
Downloading / Staging	10%	Fetches cloud image payload or stages the verified local offline archive in updates storage.
Safety Snapshot & Backup	30%	Creates an automated database snapshot and stores a pre-update copy of the active .env configuration.
Database Migrations	50%	Executes forward PostgreSQL schema migrations (Artisan migrate --force) and package SQL patches.
Service Daemon Reload	70%	Executes updater scripts, atomic service restarts, cache rebuilds, and background worker recycling.
Post-Update Health Check	90%	Performs automated diagnostic probes against the database connection, Redis broker, and HTTP API endpoints.
Completed & Promoted	100%	Finalizes the new platform version number, closes the maintenance window, and records audit log entries.

Automated Rollback & Safety Snapshots#

To prevent downtime and state corruption, the platform creates an automated configuration and database snapshot prior to making changes. If any migration or post-install health check fails, the system automatically rolls back:

Automatic Failure Detection: If a database migration throws an error or the post-update health check reports degraded connectivity, the rollback sequence triggers immediately.
Configuration & .env Restoration: The platform restores the previous .env configuration file and platform version constants from the pre-update snapshot.
Maintenance Lock Clearance: Clears maintenance flags to immediately restore user traffic and agent telemetry communication.
Manual 1-Click Rollback: Administrators can also manually trigger a rollback from the update history table if application regressions are observed.

CLI Platform Update Utility (php artisan platform:update)#

For terminal administration and CI/CD maintenance automation, the platform includes a native Artisan command:

Terminal / Shell Commands

# 1. Check for available updates
php artisan platform:update --check

# 2. Upgrade to a target version (Online Cloud)
php artisan platform:update --target-version=1.3.0

# 3. Apply an offline airgap package bundle
php artisan platform:update --package=/var/moftgate/updates/moftgate-v1.3.0.mpkg --force

Audit Trail & Update History#

All platform update actions are immutably logged to the database with detailed metadata including initiator name, execution channel, timestamps, duration, and error traces:

Audit Action	Description & Scope
platform_update.check	Triggered when an administrator queries Moftgate Cloud Registry for available updates.
platform_update.upload_package	Logged upon uploading and cryptographically validating an offline .mpkg / .tar.gz bundle.
platform_update.package_toggle	Recorded when an administrator activates or deactivates a staged update package.
platform_update.start	Logged when an automated or offline multi-stage deployment pipeline is initiated.
platform_update.completed	Recorded when all 6 pipeline stages and post-update health checks finish successfully.
platform_update.failed	Logged if any stage encounters an exception or health degradation, capturing error telemetry.
platform_update.rollback	Recorded when an automated or manual rollback restores previous system state and .env configuration.

Frequently Asked Questions#

Will endpoint agents disconnect during a server platform update?

No. Moftgate agents feature built-in offline resiliency with local SQLite caching up to 3 days (or 1 GB). If the server restarts briefly during an update (typically 5-15 seconds), agents queue security events and telemetry locally, synchronizing smoothly once the server stack health check passes.

What happens if an update fails midway through database migrations?

The orchestrator executes within defensive transaction boundaries. If a migration or post-install script fails, the platform immediately marks the process as Failed, halts progression, restores the pre-update .env configuration and database state from the automatic backup snapshot, and brings services back to a known-healthy baseline.

Can we run updates in strictly isolated air-gapped environments without Internet?

Yes. The offline package deployment workflow is specifically engineered for air-gapped defense, financial, and government infrastructures. Administrators simply upload signed .mpkg or .tar.gz packages containing all required binaries, SQL patches, and assets via the web console or CLI.

Why does the system provide an active/inactive toggle for uploaded packages?

The package toggle (is_active) enables controlled staging. MSSPs and enterprise administrators can upload version packages during business hours without making them immediately discoverable or installable by operators until an approved maintenance window arrives.

How can platform updates be automated via CI/CD or headless scripts?

You can execute the built-in Artisan CLI command: `php artisan platform:update --target-version=1.3.0 --force` or supply an offline bundle with `--package=/path/to/bundle.mpkg`. All CLI actions are fully authenticated and audited in the system log.