40 lines
2.9 KiB
Markdown
40 lines
2.9 KiB
Markdown
# Encrypted backup and recovery
|
|
|
|
RustProxy can create a password-protected **full application backup** while the proxy is running. Restore is a separate, CLI-only operation that requires the service to be stopped. A configuration-history entry is **not** a substitute for a full backup.
|
|
|
|
## Create a backup
|
|
|
|
```bash
|
|
rust-proxy --data-dir /var/lib/rustproxy backup create \
|
|
--output /private/rustproxy-backup.rpb
|
|
```
|
|
|
|
The tool asks for a password in interactive operation or may provide a generated password according to CLI mode; preserve it independently of the archive. Store the encrypted `.rpb` file **off-host** with access controls. Never place backup archives in an exposed Web Service document root.
|
|
|
|
Backups include database state, RustProxy's private Secret Store material, managed certificates and other durable files under the data directory. They **exclude** rebuildable COLD/HOT cache data, most logs/temporary files and the managed Python environment. Certificates/keys referenced through **external absolute paths**, such as `/etc/letsencrypt/live`, must be backed up and restored separately with their permissions.
|
|
|
|
## Restore
|
|
|
|
**Stop RustProxy first** and perform restore using an interactive terminal:
|
|
|
|
```bash
|
|
sudo systemctl stop rustproxy
|
|
rust-proxy --data-dir /var/lib/rustproxy backup restore \
|
|
/private/rustproxy-backup.rpb
|
|
sudo systemctl start rustproxy
|
|
```
|
|
|
|
Use an appropriate service user/elevation and keep ownership/permissions intact. RustProxy validates the password, encrypted package, manifest/checksums, SQLite data, Secret Store consistency and compatibility before activating staged restored data. A failed validation should not replace the running state, but an external off-host copy is still essential.
|
|
|
|
After restore, reattach any external certificate mounts/files and service secrets, check network listeners, then verify the panel login, Vhosts, certificates, Docker agents, cache policy and API credentials. Test a backup restore periodically on an **isolated** environment; do not first test recovery on the live server.
|
|
|
|
## Secret Store
|
|
|
|
The application stores sensitive management records using a private local encryption key. Copying only `config.sqlite3` is not enough for disaster recovery: without the associated key, encrypted records may be unreadable. Do not commit the key, database, backup password or unredacted provider credentials to source control. A lost backup password cannot be recovered by RustProxy.
|
|
|
|
External systems (system Certbot, PHP-FPM, reverse proxies, Docker host agents, DNS credentials) may need their own backups because their complete state is not owned by RustProxy.
|
|
|
|
## Before an update
|
|
|
|
Create and verify an off-host backup, record release version and current listener state, plan a maintenance window, update, then run application-level checks. Managed installation rollback is useful but should not be relied on as the sole recovery plan. See [Installation](INSTALL.md) and [Migration](MIGRATION.md).
|