Upgrading from 1.5 to 1.6
A checklist for a controller that already runs 1.5.
Version 1.6 is the biggest change to the panel so far: it gets accounts and passwords, the settings are reorganised and several security settings are switched on. Your configuration — outputs, inputs, covers, actions — stays as it is. Going through this list takes about ten minutes, plus the update itself — which can take up to an hour.
Not sure what is new? See What's new in 1.6 first.
1. Before the update
- Update to 1.5.6 first. Only 1.5.6 hands the browser over to the new panel cleanly. From an older 1.5 the old panel may keep coming back after the update until you press Ctrl+Shift+R.
- Take a backup. In the 1.5 panel open the System tab, find the Backup section and download a backup to your computer.
The update itself does not make one. If you can, also copy the
/home/boneio/boneiofolder over SSH. - Plan up to an hour, and keep the power on. On a controller coming from 1.5 the update runs system migrations at start-up. The display and the panel say what is happening. Do not cut the power while it runs — a UPS is the safe way.
- Be able to reach the controller physically — an SD card reader or a serial console. 1.6 changes how boneIO gets administrator rights on the system. It has been run on our own controllers, but a mistake at this step is the kind that needs hands on the device to repair.
2. Install the update
In the 1.5 panel: System → Check for Updates → Update to 1.6.0, or install the boneIO update in Home Assistant. Wait for the controller to restart and finish its migrations — the display shows Do not power off and the progress while they run. See Update controller.
3. Open the panel again — now over HTTPS
Open https://<controller IP>:8443 and use this address from now on. An old http://…:8090 bookmark may still open the panel,
but without encryption — step 5 switches that off.
If the browser warns about the certificate, that is expected — see
Connect to your boneIO.
4. Create the administrator account
What you see depends on whether the 1.5 panel had a password:
- You had a password in
config.yaml(web.auth) — there is no wizard. That account is moved over automatically: sign in with your old username and password. The SSH password is not changed in this case; step 5 tells you if it is stillBlack. - You had no password — the panel starts with a short wizard: Start → Account → Done. Choose a username and password for the panel
(see First-time setup for the rules). If the SSH password of the
boneiouser was still the factoryBlack, it becomes your new password as well.
Either way your configuration is not touched.
5. Review the security list
Right after signing in the panel shows Security recommendations with the number of things to look at. Click Review security (or later: Settings → Access → Security). Each item has a short explanation and, where the panel can fix it, a button that does it. On a controller upgraded from 1.5 you will usually see:
| Item | What to do |
|---|---|
| Old credentials in config.yaml | Click Remove it and confirm — the old password block is removed (a copy of config.yaml is kept first). You keep signing in as before. |
| MQTT broker password | The controller still connects to its broker with the factory password. Click Fix, set a new password for the boneio user and leave Also update boneIO's own configuration on — the controller reconnects by itself. |
| SSH login password | If it is still the factory one, change it in Settings → Access → User accounts → SSH login password, with the factory password as the current one. Or log in over SSH as boneio and run passwd. |
| Panel served in the clear | Click Move behind the proxy and confirm. After the next restart the panel answers only at https://…:8443 (and still at http://192.168.7.2:8090 over a USB cable). The change is refused if HTTPS is not working yet, so you cannot lock yourself out. |
| HTTPS certificate | Optional — see HTTPS certificate to get rid of the browser warning. |
Not ready now? Remind me tomorrow puts the prompt off by a day. Details: Security.
6. Check Home Assistant
- Entities keep working — the controller talks to Home Assistant over MQTT, and the update does not change that.
- Changing the
boneiobroker password (step 5) does not affect Home Assistant — Home Assistant signs in with its own account, usuallyhomeassistant. - Worth doing: the
homeassistantandmqttaccounts on a controller from before 1.6 still have the factory password too. Change them in Settings → Services on this controller → MQTT broker (local), and then type the new password in Home Assistant: Settings → Devices & Services → MQTT → Configure. Until you do, Home Assistant shows the boneIO entities as unavailable. - The boneIO Black add-on works without any change.
- Showing the panel in a dashboard card (iframe)? Add your Home Assistant address in Settings → Access → Security → Embedding this panel in other sites → One more address you trust. Without it the card stays empty.
7. Node-RED asks for a password now
If you use Node-RED, it now asks you to sign in with your boneIO administrator account. Your flows are unchanged. This starts once Node-RED restarts — after the next controller restart, or restart it in Settings → Services on this controller → Node-RED.
8. Things that moved
The System tab is gone. Update, backups, restart and factory reset are in Settings → Maintenance; logs and bus tools are in Diagnostics; the YAML editor is in Settings → Advanced. See Interface navigation for the full map.
9. Optional: readable names in YAML
In 1.6 entries in the configuration can have a name: instead of an id: — the identifier is made from the name.
Old files with id: keep working, so you do not need to change anything. If you edit YAML by hand and want to switch,
see What's new in 1.6.
Something went wrong?
- Cannot sign in / forgot the password — reset it over SSH: Accounts and access.
- The controller does not start after the update — the panel opens in recovery mode; see Troubleshooting.
- You want to go back — Settings → Maintenance → Software update → Available Versions lets you install an older version. Talk to us on Discord first: the system changes 1.6 made (for example SSH hardening) stay in place.