This mainly adds an upgrade howto to facilitate continuing upgrades of
this service.

service/survey.md

-Tor project runs a survey services to avoid using external services that won't be privacy friendly.
+Tor Project runs a self-hosted instance of [LimeSurvey](https://www.limesurvey.org/) to conduct user research and feedback collection.
 
-# Tutorial
+The URL for this service is https://survey.torproject.org
 
-The website is available at <https://survey.torproject.org/>
-
-The survey is also accessible via onion address at http://bogdyardcfurxcle.onion/
+[[_TOC_]]
 
 # How-to
 
-The service uses [limesurvey](https://www.limesurvey.org/) and runs on [Subnotabile](https://db.torproject.org/machines.cgi?host=subnotabile). The [upstream user manual](https://manual.limesurvey.org/) should cover most of your needs.
+## Upgrades
+
+We don't use the paid [ComfortUpdate](https://community.limesurvey.org/comfort-update-extension/) extension that is heavily promoted by LimeSurvey.
+
+Instead, we checkout release tags from a copy of the [GitHub repository](https://github.com/LimeSurvey/LimeSurvey).
+
+The steps to upgrade LimeSurvey are:
+
+ 0. `cd /srv/limesurvey`
+ 1. Stop Apache2 using `systemctl stop apache2 puppet-run.timer` (no maintenance mode in LimeSurvey)
+ 2. Fetch new git tags from upstream with `git fetch`
+ 3. Checkout latest tag in 5.x series, eg. `git checkout 5.3.28+220727`
+ 4. Run database upgrade `sudo -u www-data php application/commands/console.php updatedb`
+ 5. Resume Apache2 `systemctl start apache2 puppet-run.timer`
+ 6. Login to the [admin interface](https://survey.torproject.org/admin) and validate running version number
+
+## Disaster recovery
+
+In case of a disaster restoring both `/srv/limesurvey` and the PostgreSQL database on a new server should be sufficient to get back up and running.
+
+# Reference
+
+## Design
 
-## Administration
+This service runs on a standard Apache/PHP/PostgreSQL stack.
 
-The admin interface is available under [/admin](https://survey.torproject.org/admin). You can request an admin account from an existing admin, contact information should be visible in the main page.
\ No newline at end of file
+Self-hosting a LimeSurvey instance allows us to better safeguard user-submitted data as well as allowing us to make it accessible through an onion service.