Platform disaster recovery

Operator recovery kit

This guide is for the platform operator. Application owners normally use service backups. Recovering the control plane needs an off-host copy of the source, bootstrap settings, R2 connection details, the encrypted database backup, and its private age identity. Losing the server must not mean losing the only recovery key.

The recovery kit contains secrets. Keep it outside the repository, outside the production VPS, and outside the backup bucket. Use protected local storage and an additional password-protected archive. Keep its password separately in a password manager.

Encryption keys

Install the age tools first, for example brew install age on macOS. Generate a native X25519 identity on the operator computer:

umask 077
age-keygen -o /protected/platform-backup.agekey
age-keygen -y /protected/platform-backup.agekey

Create /protected as a writable private directory or replace it with your protected path. age-keygen -y prints the public age1... recipient. Only that public value goes on the server as PLATFORM_BACKUP_AGE_RECIPIENT. The private identity must stay off the VPS. Without it, new backups cannot be decrypted.

If the recipient is missing, encryption fails closed; Upferry does not fall back to plaintext. Automatic pruning of platform copies stays paused until PLATFORM_BACKUP_AGE_VERIFIED_RECIPIENT matches the current public recipient after a successful off-host restore. This guard does not pause application backup retention.

Prepare and test off-host

From an authorized checkout of the Upferry repository, with SSH access and local Docker available: