# Backups

The `famapp-backup` service performs nightly compressed `pg_dump` of both
`famapp-db` and `authentik-db` at **02:00 server time**.

## Storage layout

```
/backups/           (named Docker volume: famapp_backups)
  famapp/
    daily/          ← last 14 days
    weekly/         ← last 8 Sundays
    monthly/        ← last 6 first-of-month dumps
  authentik/
    daily/
    weekly/
    monthly/
```

Dump files are named `YYYY-MM-DD.dump` in custom (`-Fc`) format (internal
compression, ~3–5× smaller than plain SQL).

## Retention

| Tier    | Kept | Trigger          |
| ------- | ---- | ---------------- |
| daily   | 14   | every night      |
| weekly  | 8    | Sunday night     |
| monthly | 6    | 1st of the month |

Retention is enforced by `retain.sh` at the end of each `backup.sh` run.

## Restore procedure

### 1. Identify the dump

```sh
# List available dumps
docker exec famapp-backup-1 ls /backups/famapp/daily/
```

### 2a. Restore inside the backup container (recommended)

```sh
docker exec famapp-backup-1 /scripts/restore.sh \
  /backups/famapp/daily/2024-06-01.dump \
  postgres://famapp:SECRET@famapp-db:5432/famapp
```

Replace `SECRET` with the value of `FAMAPP_DB_PASSWORD` in your `.env` file.
For authentik:

```sh
docker exec famapp-backup-1 /scripts/restore.sh \
  /backups/authentik/daily/2024-06-01.dump \
  postgres://authentik:SECRET@authentik-db:5432/authentik
```

### 2b. Restore to a separate database (safe — non-destructive)

Create a fresh target database first, then restore into it:

```sh
# Create the target DB
docker exec famapp-db-1 createdb \
  -U "$FAMAPP_DB_USER" famapp_restore

# Restore
docker exec famapp-backup-1 /scripts/restore.sh \
  /backups/famapp/daily/2024-06-01.dump \
  postgres://famapp:SECRET@famapp-db:5432/famapp_restore
```

### 2c. Restore on a fresh host (disaster recovery)

```sh
# Copy the dump file out of the volume
docker cp famapp-backup-1:/backups/famapp/daily/2024-06-01.dump ./

# Spin up a temporary Postgres container and restore
docker run --rm \
  -e PGPASSWORD=SECRET \
  -v "$(pwd)/2024-06-01.dump:/dump.dump:ro" \
  postgres:16-alpine \
  pg_restore -h <new-db-host> -U famapp -d famapp \
    --no-owner --no-acl /dump.dump
```

## Off-site replication

The backups live in the `famapp_backups` Docker named volume. To copy them
to another host, rsync the volume's data directory periodically (e.g. from a
host cron job):

```sh
# On the Docker host, add to /etc/cron.d/famapp-rsync:
30 3 * * * root rsync -a --delete \
  /var/lib/docker/volumes/famapp_backups/_data/ \
  user@offsite-server:/opt/famapp-backups/
```

Encryption at rest is handled at the disk/filesystem layer (e.g. LUKS).