From fc63b45717e336e06fd766f492271384cfff6ebc Mon Sep 17 00:00:00 2001
From: alex <alex@alexloehr.net>
Date: Mon, 12 Oct 2026 07:36:48 +0000
Subject: [PATCH] GS-2555

---
 UPDATE.md |   15 +++++++++------
 1 files changed, 9 insertions(+), 6 deletions(-)

diff --git a/UPDATE.md b/UPDATE.md
index d4e4217..6fe753e 100644
--- a/UPDATE.md
+++ b/UPDATE.md
@@ -12,11 +12,11 @@
 
 Production consists of **three parts** that may change independently:
 
-| Part | Location | Updated with |
-|------|----------|--------------|
+| Part                 | Location                                     | Updated with                   |
+|----------------------|----------------------------------------------|--------------------------------|
 | Node.js REST service | the project dir on the server, run via `pm2` | code + `npm install` + restart |
-| Frontend (Vue SPA) | `vue/dist` (built, **not** in git) | `npm run build` |
-| PHP component | `$ILIASBASEDIR/globus-ilias-rest` | `copyPhpHati` |
+| Frontend (Vue SPA)   | `vue/dist` (built, **not** in git)           | `npm run build`                |
+| PHP component        | `$ILIASBASEDIR/globus-ilias-rest`            | `copyPhpHati`                  |
 
 A full update therefore touches all three; a code-only change may only need the
 first two.
@@ -38,8 +38,6 @@
    - note the current git revision (`git rev-parse HEAD`) or tag
    - the settings are in git, but keep a copy of the server's
      `settings.prod.json` if it was modified on the server
-3. **Do not commit secrets**: `settings.prod.json` and `php/globus-ilias-rest/token`
-   contain tokens/credentials. Treat them as secret.
 
 ## Update steps
 
@@ -123,6 +121,11 @@
     # service version
     curl https://www.lernen-mit-globus-baumarkt.de/popcorn/api/version
 
+> The `/api/version` endpoint must return the version from `package.json`
+> (e.g. `{"version":"0.4.0"}`). If it differs, the deployed code is not the
+> revision you expected — check the update/restart steps above before
+> continuing.
+
     # authenticated API
     curl "https://www.lernen-mit-globus-baumarkt.de/popcorn/api/user?token=$TOKEN"
 

--
Gitblit v1.8.0