Publishing releases

Customers can only install or update to versions you've published in the dashboard. Publishing is a three-step process: build, upload, register.

1. Build the binary

From the project root:

cd backend
GOOS=linux GOARCH=amd64 go build \
  -ldflags "-X main.BuildVersion=v2.13.0" \
  -o proxima-gateway-linux-amd64 .

shasum -a 256 proxima-gateway-linux-amd64

Save the resulting hex digest — you'll paste it into the dashboard.

The BuildVersion ldflag is what the proxy reports in heartbeats. If you forget it, every heartbeat reports dev and the dashboard can't tell versions apart.

2. Upload to R2

The binary lives in the same R2 bucket that hosts the GeoIP databases, under a releases/ prefix:

proxima-geoip/
├── GeoLite2-City.mmdb
├── GeoLite2-ASN.mmdb
├── GeoLite2-Country.mmdb
└── releases/
    ├── v2.12.0/proxima-gateway-linux-amd64.tar.gz
    └── v2.13.0/proxima-gateway-linux-amd64.tar.gz

Use whatever upload flow you already have (Cloudflare dashboard, wrangler, S3-compatible CLI). The bucket is gated by the same Worker as GeoIP — the installer authenticates with the GEOIP_TOKEN env var on the dashboard.

3. Register in the dashboard

Admin → Releases → Publish Release:

Field	Value
Version	`v2.13.0` (must match the `BuildVersion` ldflag)
Binary URL	`https://geoip.proximagateway.com/releases/v2.13.0/proxima-gateway-linux-amd64.tar.gz`
SHA-256	The hex digest from `shasum -a 256`
Release notes	Optional; shown to customers in the update banner
Mark as latest	Flip on so customers see "Update available"

Click Publish. If "Mark as latest" was on, any other release with that flag is unmarked in the same transaction (only one row can be latest = true at a time — enforced by a partial unique index).

What customers see immediately

Already-installed customers refresh /app → see Update available: v2.13.0 banner with your release notes
New customers who haven't installed yet → next click of Install Proxima Gateway uses the new version

Sanity check before publishing

Verify the URL works with the bearer token before you mark it latest. From your laptop:

source frontend/go-auth-proxy-frontend/.env
curl -fsSL -I -H "Authorization: Bearer $GEOIP_TOKEN" \
  "https://geoip.proximagateway.com/releases/v2.13.0/proxima-gateway-linux-amd64.tar.gz"

Should return 200. If 403, the Worker isn't gating the path you think it is — fix that before customers click Update and find out.

Rollback

Spotted a regression? In Admin → Releases, click the empty star next to the previous version to mark it as latest. The current latest is unmarked automatically. Customers see "Update available: v2.12.0" the next time they refresh — they click Update to roll back.

Editing or deleting a release

Both are available from the row's pencil/trash icons. Deleting a release only removes the dashboard's record — customers running that version keep running fine since the binary lives on R2, not on the dashboard.