Every night
When Asphalt OS runs on your own server, it backs itself up every night at 2:00 AM: the whole database, every uploaded file (photos, receipts, recordings and documents), and the server's settings file with the master key. Each database backup is restored into a scratch copy and counted before it is kept, so a backup that would not restore is never called good.
- Every backup file is encrypted to your own key before it touches the disk. A public key that can only encrypt lives on the server; the private key that opens the backups is made once on your PC and kept in your password manager, never on the server. A stolen or ransomed server gives up nothing from its backups, and the encrypted files are safe to copy anywhere. Without the public key no backup is written at all, and the install won't finish.
- Backups are kept for 30 days, then the oldest are removed.
- The server's status shows how old the newest backup is and whether its check passed. A nightly backup that stopped makes the backup service unhealthy, so it is seen.
- A second copy, to another folder or an off-site bucket (Backblaze B2, Wasabi, Amazon S3 or Cloudflare R2), can be switched on. It is a good idea, and safe, because the copies are encrypted too.
Restoring
Whoever runs the server can:
- Check a backup without any key: that it is a proper encrypted file for your key, untouched.
- Restore a database backup. It asks them to type RESTORE and paste the private key from the password manager (used in memory for the seconds it takes), restores into a scratch copy first, and keeps the old database under another name.
- Put uploaded files back. Files already there are kept.
- Bring the settings file back from a backup, so a whole new server can be rebuilt from an off-site copy.
An upgrade refuses to run without a backup less than 24 hours old.
The master key on the server locks every uploaded file, every saved service key and everyone's two-factor keys. It travels with the backup set, and a database backup refuses to be restored under a different key. If it is truly lost, the files uploaded before are unreadable for ever, everyone sets two-factor up again, and the service keys are entered again on Connections. Keep the settings file's backup where you can find it.
If a backup fails, it is tried again the next night, and the server takes one by itself when it starts and the newest is older than a day. Whoever runs the server can take one by hand in the meantime.