Configuration backups
A backup of your organization is a copy of what you set up in the panel: the company data, the users and the roles and, for every subscription, the name, the devices, the plan and the limits. It can also hold the searchable logs of the subscriptions. It is there to put things back as they were after a mistake, for example a device or a user deleted by accident.
The backups are in Organization › Backup. To make and restore them you need a role that allows it.
This page is about the copy of the organization. The copies of the logs of a single CSP (Central Syslog) subscription are in the Backup tile of the subscription. For an off-site copy of WFP (Web File), the backup holds its accounts and shared folders, not the files.
The Backup page
At the top, the page sums up the situation:
- Last copy, with its outcome;
- Next copy, with the schedule told in one sentence (for example: every day at 02:00, always a full copy, keeps the last 7 copies, on the server), or "No schedule: the copies are made by hand only.";
- Space, the one taken by the copies.
The Make a copy now and Schedule buttons open the pages described below. The Copies list shows every copy with Date, Type, Content, Key and Status, and the Download, Restore and Delete buttons.
Making a copy now
Make a copy now prepares a copy with everything already chosen: you only confirm. The copy is made in the background: the list shows when it is ready (Queued, In progress, Completed) and an email tells the outcome.
In the Advanced options you can change the Encryption (see below) and the address that receives the email with the outcome (Send the outcome to).
The encryption
| Choice | What it means |
|---|---|
| With the key of the server | The panel encrypts and decrypts by itself. The download comes decrypted and the restore is automatic. This is the normal choice |
| With my personal age key | Only your private key opens the backup, not even the server can read it. Write the Public age key (it starts with age1). If you lose the private key, the backup is lost |
| In plain text | No encryption: whoever gets the file reads it, logs included |
The personal key is for those who want to keep copies that nobody else can open, not even whoever runs the server. The key is made with the age program, on your computer. Keep the private key in a safe place, apart from the copies.
The schedule
Schedule makes the copies by itself.
| Field | What to choose |
|---|---|
| Make the backups on schedule | Turns the schedule on |
| Every and At | Day, Week or Month, and the time. The time is in the time zone of whoever saves the schedule |
| A full backup, then incremental ones with only the new logs | After a full copy, the next ones hold only the new logs: smaller and faster. A new full backup every week or month |
| Copies to keep | How many copies to keep. The oldest are deleted; the copies made by hand are never touched |
| Where | On the server, On a remote destination, or On the server and on a remote destination |
With incremental backups a "copy" is a full backup with the incremental ones that follow it. The restore rebuilds the chain from the full backup by itself.
Press Save the schedule.
Remote destinations
A remote destination is a server of yours where the schedule copies the backups: an SFTP or FTP server, or an S3-compatible storage. So the copies also stay outside the server of the panel. The files arrive as they are on the server, encrypted if they are, and the remote space does not count in your limits.
In Remote destinations, Add a destination asks for the Name, the Type and the access data:
- SFTP or FTP: Server, Port, User, Password or Private SSH key, the Folder. With FTP, turn on FTP with TLS (FTPS) if the server supports it: without TLS the password travels in clear.
- S3: Bucket, Region, Endpoint (empty for Amazon S3), Access key, Secret key; Path-style addresses for MinIO and some NAS.
For SFTP, the panel reads the fingerprint of the key of the server and asks you to confirm it: check it on the server with ssh-keygen -lf /etc/ssh/ssh_host_ed25519_key.pub. From then on the panel connects only to a server with that fingerprint.
The panel tests the destination when you save it. Test tests it again whenever you want; the list says whether it works and when it was tested. If a copy does not reach the destination, the panel says so and the file stays on the server.
Deleting a destination does not delete the copies already there, but the panel no longer reaches them.
Restoring
Restore, on the row of a copy, opens a page in steps.
- What to restore: the whole copy or a part of it, for example a single subscription; the logs, the configuration or both. For the logs you can choose the period (Logs from … to).
- The key of the copy, only for a copy encrypted with your personal key: write the private age key (it starts with
AGE-SECRET-KEY-). It is used for this restore only and is not stored. - Summary and confirmation: what happens, and the confirmation.
What comes back:
- Logs: the missing ones of the period come back; the ones still in the panel and the ones arrived later stay.
- Configuration: company data, users, roles and devices go back to how they were in the copy, and what was added later is removed. That is why the panel asks you to confirm with "I understand that the configuration goes back to the one of …".
The restore runs in the background; the email and the list tell its outcome.
Before restoring the configuration, think about what changed after the copy: a user created later, for example, disappears. If you only need to get some logs back, restore only the logs.
Downloading and deleting
Download saves the copy on your computer. A copy with the key of the server comes decrypted.
Delete removes it for good. For a full copy with incremental ones, it also deletes the incremental ones that follow it.