[{"data":1,"prerenderedAt":118},["ShallowReactive",2],{"seo-verification":3,"blog-routine-correctifs-apps-self-hosted-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"title":9,"excerpt":10,"readTime":11,"views":12,"isPinned":13,"publishedAt":14,"category":15,"categories":21,"featuredImage":23,"bgImage":24,"posterImage":25,"relatedSolution":23,"intro":26,"sections":27,"ctaTitle":70,"ctaBody":71,"ctaButton":72,"ctaUrl":73,"relatedPosts":74},224,"routine-correctifs-apps-self-hosted","Self-hosted apps: the patching routine","Inventory, security advisories, a patch window, backups and post-checks: the routine most self-hosted estates are missing.",7,0,false,"2026-08-05T00:00:00+00:00",{"id":16,"name":17,"slug":18,"color":19,"icon":20},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[22],{"id":16,"name":17,"slug":18,"color":19,"icon":20},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Froutine-correctifs-apps-self-hosted-poster.svg","Self-hosting means taking back a job the vendor used to do for you without ever billing it separately: applying its security patches. July 2026 was the reminder, with CVE-2026-63077 in JetBrains TeamCity, already handled on the vendor's cloud side while every On-Premises instance waited for its own administrator. Here is the routine that closes the gap.",[28,32,41,44,63,67],{"type":29,"title":30,"body":31},"h2","Patching is part of what you take back","In a SaaS product, the security update is invisible: the vendor rolls it out across its own fleet, sometimes before the public announcement. The same vulnerability on an instance you host stays open until someone applies the fix. CVE-2026-63077 illustrates the gap: the flaw allowed unauthenticated execution of system commands on TeamCity On-Premises, fixed in versions `2025.11.7` and `2026.1.3`, while the same vendor's cloud deployments required no action from customers. The gap is not technical, it is organisational.",{"type":33,"title":34,"items":35},"ul","What breaks when nobody owns it",[36,37,38,39,40],"**The installed version becomes untraceable** — without an inventory, nobody knows which component runs on which machine, and a security advisory cannot even be triaged.","**The advisory reaches a dead address** — vendor notifications go to a departed contractor's mailbox, or to an alias nobody reads any more.","**The backlog grows into a dead end** — three major versions behind turns a ten-minute patch into a two-day migration.","**The update runs without a safety net** — without a verified backup, a schema migration applied and then regretted cannot be replayed backwards.","**Nobody checks afterwards** — the service restarts, the home page answers, and a queue consumer stays dead for weeks without a single signal.",{"type":29,"title":42,"body":43},"The four prerequisites of a routine that holds","A patching routine does not rest on goodwill, it rests on four written things. An inventory: every application, its version, its host, its owner. Advisory sources narrowed to the components actually installed, because a general feed drowns the signal. An announced window: a recurring slot where downtime is accepted, otherwise the patch waits for a quiet moment that never comes. A restorable backup, tried before it is needed. Without those four, every update turns back into a project to negotiate.",{"type":45,"title":46,"steps":47},"steps","The routine, in five moves",[48,51,54,57,60],{"title":49,"body":50},"Inventory what is actually running","List every exposed application, its exact version, its host and its owner. `docker compose ls` then `docker image inspect` give the real state of your containers; `dpkg -l` or `rpm -qa` that of system packages. Keep this file under version control next to your configurations: an inventory that lives only in someone's memory does not exist.",{"title":52,"body":53},"Subscribe to advisories for installed components, not the whole internet","For each line of the inventory, open a named subscription: the repository's Atom release feed (`https:\u002F\u002Fgithub.com\u002Forg\u002Frepo\u002Freleases.atom`), the vendor's security mailing list, or an NVD query filtered on the product. One subscription per component stays triageable. Route them all to a shared mailbox, never to a personal address.",{"title":55,"body":56},"Set a patch window, and a fast lane","Reserve a recurring slot where downtime is accepted and announced. Two classes are enough: ordinary patches wait for the window; a critical flaw under active exploitation triggers immediate application, outside the window. Writing that rule before the incident spares you from negotiating it during.",{"title":58,"body":59},"Back up right before, and prove the restore","Before applying, take a database export (`mysqldump`, `pg_dump`) and a dated backup of the data volume, then record the version you are leaving. A hypervisor snapshot and an application-level backup (`restic`, `borg`) do not cover the same risk: keep both, and test a restore while it is not urgent.",{"title":61,"body":62},"Verify behaviour afterwards, then hand it to a probe","An open port proves nothing. After each patch, check what the application really does: health endpoint response (`curl -fsS https:\u002F\u002Fyour-domain.com\u002Fhealth`), queues being consumed, a test email actually sent, no new errors in the logs. Then write those checks into permanent monitoring, with Uptime Kuma for instance, which replays them without you.",{"type":64,"title":65,"body":66},"tip","Shrink the surface instead of chasing patches","An admin console or an agent protocol exposed to the public internet turns every unauthenticated flaw into an immediate incident. Put those interfaces behind a private network, a VPN or an allowlist. Updating remains mandatory, but the delay between an advisory and your patch stops being a window of exposure open to everyone.",{"type":29,"title":68,"body":69},"Who updates what, exactly","On a server you administer, the split must stay clear. The host provides and maintains the foundation: the machine, the network, the storage, hypervisor availability. The applications you install on top — their versions, their patches, their configuration — remain under your administration. Nobody will update them for you, and that is the price of the control you chose. The routine described here is what makes that split sustainable: it turns a diffuse load into a short, predictable appointment.","The foundation is ours, your patch schedule stays yours","Root access, complete logs and the freedom to install your own backup and monitoring tools: the infrastructure we operate lets you apply your patches at the moment you decided.","See our security approach","\u002Fpourquoi\u002Fsecurite",[75,90,104],{"id":76,"slug":77,"title":78,"excerpt":79,"readTime":11,"views":12,"isPinned":13,"publishedAt":80,"category":81,"categories":87,"featuredImage":23,"bgImage":24,"posterImage":89,"relatedSolution":23},202,"securiser-chaine-approvisionnement-npm-ci","Securing Your npm CI Supply Chain After AsyncAPI","Lockfile policy, hash verification, SLSA provenance and automated SCA: how to harden your CI pipeline after the AsyncAPI incident of July 2026.","2026-08-01T00:00:00+00:00",{"id":82,"name":83,"slug":84,"color":85,"icon":86},4,"Development","developpement","bg-warning\u002F10 text-warning","dev",[88],{"id":82,"name":83,"slug":84,"color":85,"icon":86},"\u002Fblog\u002Fcovers\u002Fsecuriser-chaine-approvisionnement-npm-ci-poster.svg",{"id":91,"slug":92,"title":93,"excerpt":94,"readTime":11,"views":95,"isPinned":13,"publishedAt":96,"category":97,"categories":98,"featuredImage":23,"bgImage":24,"posterImage":100,"relatedSolution":101},113,"sauvegardes-restic-vps","Automate Your VPS Backups with Restic","Automate your VPS backups with Restic: encrypted snapshots, deduplication and shipping to S3 or any object backend.",781,"2026-02-27T00:00:00+00:00",{"id":16,"name":17,"slug":18,"color":19,"icon":20},[99],{"id":16,"name":17,"slug":18,"color":19,"icon":20},"\u002Fblog\u002Fcovers\u002Fsauvegardes-restic-vps-poster.svg",{"categorySlug":102,"appSlug":103},"securite","restic",{"id":105,"slug":106,"title":107,"excerpt":108,"readTime":109,"views":110,"isPinned":13,"publishedAt":111,"category":112,"categories":113,"featuredImage":23,"bgImage":24,"posterImage":115,"relatedSolution":116},105,"superviser-vps-uptime-kuma","Monitoring your VPS with Uptime Kuma","Deploy Uptime Kuma on your VPS to monitor your sites and services self-hosted, with alerts and a public status page.",6,1520,"2026-03-07T00:00:00+00:00",{"id":16,"name":17,"slug":18,"color":19,"icon":20},[114],{"id":16,"name":17,"slug":18,"color":19,"icon":20},"\u002Fblog\u002Fcovers\u002Fsuperviser-vps-uptime-kuma-poster.svg",{"categorySlug":102,"appSlug":117},"uptime-kuma",1785896852892]