Docs
Open in panel → /app · appliance
Backup & restore
PostMTA Hosted ships automated appliance backup with GPG-detached
signatures and a restore drill. This is the operator-facing contract;
the full runbook lives in the appliance repo under docs/ops/PRODUCTION.md.
What ships
| Piece | Role | Matrix |
|---|---|---|
scripts/backup-appliance.sh |
Postgres dump + configs + Kumo managed tar; optional GPG sign | M53b |
| WAL / incremental mode | Tighter RPO when postmta-hosted-backup-wal.timer is enabled |
M53c |
scripts/restore-appliance-drill.sh --verify-gpg |
Refuses extract when signature fails | M66 |
postmta-hosted-backup.timer |
Daily oneshot (optional enable) | — |
postmta-hosted-backup-wal.timer |
Hourly WAL-mode (off by default) | — |
RPO claim: ≤ 24h with the daily timer enabled. Take an extra backup
before upgrades. Lab artifacts land under artifacts/qa/; on-site default
is /var/backups/postmta-hosted.
Enable the timer
sudo systemctl enable --now postmta-hosted-backup.timerUnits ship in infra/systemd/.
Restore drill
bash scripts/restore-appliance-drill.sh --check
bash scripts/restore-appliance-drill.sh --verify-gpg
bash scripts/check-backup-gpg.sh # sign + tamper + reject (MOCK gpg OK)Related
- Production runbook — component health + upgrade notes
- Air-gap updates — signed offline release bundles
- ECC verify — live battle-test evidence including M66
Last verified: Sun Jul 12 2026 17:00:00 GMT-0700 (Pacific Daylight Time). Cross-link maintained byscripts/check-docs-drift.sh (M54).