Backups

A fresh installation does not switch backups on by itself. One command does, and proves them once: it asks where backups go, sets up the schedule, then runs a backup, a restore rehearsal and a check, and reports "Protected" only if all three passed. Do not rely on the installation for data you need to keep until that is done.

What you provide

• A place that is not the server: an SFTP host, an S3-compatible bucket or a second disk.
• An age key pair made on your own machine. The server only ever gets the public half, so only you can open the encrypted copy of its settings.
• An uptime check that the nightly job reports to, so you hear when it stops.
• A repository password. Keep it in a password manager: without it every backup is unreadable.

What you get

Nightly encrypted backups, a monthly restore drill, an export of everything, and erasure of one person's data on request. The console's Backup page is a read-only record: Protected (last night's backup was verified and a restore was rehearsed recently), Unproven, or Not protected. It runs nothing itself.

If the server is lost, a guided restore brings the installation back onto a fresh server from the latest snapshot. The restore path has been tested with stand-ins only, so treat the first real restore as a rehearsal on a spare server.

The commands and every refusal are in the install guide: backups and the restore drill.