Backups — EnclaveStack

Overview

A backup copies a database or a cache to a bucket on a schedule and keeps the last few copies. From any copy you can restore, into the same database or into a new one.

When to use it

Every database holding data you can’t lose.
Before a risky change, with Back up now.
To keep copies off the machine, in an outside S3-compatible bucket.

How it works

Logical dumps: pg_dump in custom format for PostgreSQL; a fresh RDB snapshot for Redis; each engine’s own dump.
Streaming upload: The dump streams straight into a multipart upload (16 MiB parts) with a SHA-256 checksum, never kept whole in memory.
Scheduler: The same cron scheduler as jobs; old copies past your keep count are removed.

Each run dumps the source inside its own container and uploads the stream to the bucket. Restoring checks the checksum first; replacing an existing database takes a safety backup before it.

Architecture

A backup streams a dump into a bucket; restore reads it back.

Flows

A nightly backup

At the scheduled time the run starts.
The engine’s dump tool writes to a stream that goes straight to the bucket.
The run records its size and checksum; the oldest copies beyond Keep are removed.

Restoring

Choose a run and Restore, into a new database or the same one.
The checksum is verified first.
Replacing takes a safety backup before writing.

Set it up

In the console

Open Backups and choose New backup.
Choose the database or cache, the bucket, the schedule and how many to keep.
Use Back up now to try it.

With the CLI

enclave backup create orders-nightly --source database/orders --bucket uploads --schedule "0 3 * * *" --keep 7 --wait

With OpenTofu

OpenTofu configuration

resource "enclave_backup" "orders_nightly" {
  name     = "orders-nightly"
  source   = { database = "orders" }
  bucket   = "uploads"
  schedule = "0 3 * * *"
  keep     = 7
}

Settings reference

Every setting and output of the OpenTofu resource; the console and the CLI use the same names in their own words. Generated from platform 4d30582.

`enclave_backup`
Name	Type	Use	What it does
`name`	text	required	Name of the backup: 3–40 lowercase letters, digits or hyphens, starting with a letter. Changing it replaces the backup.
`source`	list of objects	required	What to back up: { database = … } or { cache = … }. Changing it replaces the backup.
`bucket`	text	optional	Store backups in this EnclaveStack bucket. Exactly one of bucket or s3.
`keep`	number	optional	Keep this many backups (1–365).
`keep_days`	number	optional	Also delete backups older than this many days (0: no age limit). The newest is always kept.
`prefix`	text	optional	Object key prefix.
`project`	text	optional	The project to create it in. Defaults to the provider's project (ENCLAVE_PROJECT, else default). Changing it replaces the resource.
`s3`	list of objects	optional	Store backups in external S3. Exactly one of bucket or s3.
`schedule`	text	optional	5-field cron or @hourly, @daily, @weekly, @monthly.
`time_zone`	text	optional	IANA time zone for the schedule (default: the machine's).
`timeout_seconds`	number	optional	Stop a backup after this many seconds (60–86400).
`id`	text	output	Resource ID.
`last_run_status`	text	output	succeeded, failed, timed_out or skipped.
`last_success_at`	text	output	When the last backup succeeded (RFC 3339).
`next_run_at`	text	output	When the next backup is due (RFC 3339).

Limits and security

Good to know

A bucket on the same machine doesn’t protect against losing the machine; use an outside bucket for that.

Security

Outside S3 credentials are read from a secret; passwords go to dump tools through the environment, never as arguments.