How to Upgrade Connectors Running in Linux as a systemd Service

If you are running Twingate Connectors as a native Linux systemd service, the instructions below cover how to upgrade Connectors. Please keep in mind the best practices for upgrading detailed in Upgrading Connectors to avoid downtime for your users.

See the Linux systemd deployment documentation for more information on using our systemd service.

Checking the Connector Version

If you’d like to check the currently running version of a Connector running via systemd, you can do so using the following command:

twingate-connector -V

The latest build version number and other update notes are available in the Connector Release Notes.

Ubuntu (apt)

The following steps will upgrade the twingate-conector package and service using apt.

sudo apt update
sudo apt install -yq twingate-connector
sudo systemctl restart twingate-connector

Fedora and CentOS (dnf)

The following steps will upgrade the twingate-connector package and service using dnf.

sudo dnf update
sudo dnf --best install twingate-connector
sudo systemctl restart twingate-connector

Automated connector updates

Simple Cron Job Example

It is possible to use standard Linux tools to automate regular updating of Connectors. For example, for Ubuntu Linux the following will create a weekly cron job to update and restart the Connector.

sudo tee -a /etc/cron.weekly/update-twingate-connector > /dev/null <<EOF
#!/bin/bash
sudo  -- sh -c 'apt update && apt install -yq twingate-connector && systemctl restart twingate-connector'
EOF
sudo chmod +x /etc/cron.weekly/update-twingate-connector

Advanced Update Automation

For more advanced Connector update automation, you may want to consider using a more flexible script as well as adding a logging mechanism. For example, if you wanted to always remain one version behind the latest Connector version, and to run updates weekly while logging the results, you could use something similar to our automated Connector update template script.

The script is designed to be run on an Ubuntu or Debian based server as a cron job, and it can:

• Check the installed version of a package (as specified by the first argument)
• Fetch all available versions from APT
• Identify the latest and second-latest versions
• Compare installed → latest/second-latest
• Decide if the system should move to the second-latest version
• Install that exact version when --apply is used
• Allow downgrades when --allow-downgrades is enabled
• Print what it’s doing (or would do) in a dry run

In order to implement this script on a host running a Twingate Connector, you could run the following command:

sudo sh -c '
  curl -fsSL "https://raw.githubusercontent.com/Twingate-Solutions/general-scripts/refs/heads/main/bash-scripts/keep-one-behind.sh" \
    -o /usr/local/sbin/keep-one-behind.sh &&
  chmod +x /usr/local/sbin/keep-one-behind.sh &&
  echo "0 2 * * 0 root /usr/local/sbin/keep-one-behind.sh twingate-connector --apply --allow-downgrades >> /var/log/keep-one-behind.log 2>&1" \
    > /etc/cron.d/twingate-connector-one-behind
'

This will download the script and save it to /usr/local/sbin/keep-one-behind.sh, make it executable, and then create a cron job that runs the script every Sunday at 2 AM, applying updates to the twingate-connector package while allowing downgrades. The output of the script will be logged to /var/log/keep-one-behind.log. It will always remain one version behind the latest available version.

Be sure to monitor the log file and adjust the cron schedule as needed to fit your maintenance windows and usage patterns.