Backup & Restore

Backup & Restore

Protect your SSH-KLM deployment with comprehensive backup strategies.

What to Backup

Component	Location	Priority
Database	PostgreSQL	Critical
Configuration	/etc/ssh-klm/	Critical
Encryption Keys	Vault/KMS	Critical
Agent Backups	/var/lib/ssh-klm/backups	High
Logs	/var/log/ssh-klm/	Medium

Database Backup

PostgreSQL Dump

# Full backup
pg_dump -h localhost -U sshklm -d sshklm_production \
  --format=custom \
  --file=/backup/sshklm-$(date +%Y%m%d).dump

# Compressed backup
pg_dump -h localhost -U sshklm -d sshklm_production \
  | gzip > /backup/sshklm-$(date +%Y%m%d).sql.gz

Automated Backup Script

/opt/scripts/backup-sshklm.sh

#!/bin/bash
BACKUP_DIR="/backup/sshklm"
RETENTION_DAYS=30
DATE=$(date +%Y%m%d_%H%M%S)

# Create backup directory
mkdir -p $BACKUP_DIR

# Database backup
pg_dump -h localhost -U sshklm -d sshklm_production \
  --format=custom \
  --file=$BACKUP_DIR/db-$DATE.dump

# Configuration backup
tar -czf $BACKUP_DIR/config-$DATE.tar.gz \
  /etc/ssh-klm/ \
  /var/lib/ssh-klm/

# Cleanup old backups
find $BACKUP_DIR -type f -mtime +$RETENTION_DAYS -delete

echo "Backup completed: $DATE"

Cron Schedule

# Daily at 2 AM
0 2 * * * /opt/scripts/backup-sshklm.sh >> /var/log/sshklm-backup.log 2>&1

Configuration Backup

# Backup configuration
tar -czf sshklm-config-backup.tar.gz \
  /etc/ssh-klm/ \
  /opt/ssh-klm/.env

# Include Kubernetes secrets (if applicable)
kubectl get secrets -n ssh-klm -o yaml > k8s-secrets-backup.yaml

Encryption Key Backup

⚠️ Critical: Without encryption keys, backed-up data cannot be restored.

HashiCorp Vault

# Export Vault data (requires root token)
vault operator raft snapshot save vault-snapshot.snap

AWS KMS

KMS keys are managed by AWS. Ensure:

1. Key deletion protection is enabled
2. Cross-region replica exists
3. Key policy allows recovery

Restore Procedures

Database Restore

# Stop SSH-KLM services
sudo systemctl stop ssh-klm

# Restore database
pg_restore -h localhost -U sshklm -d sshklm_production \
  --clean --if-exists \
  /backup/sshklm-20260106.dump

# Start services
sudo systemctl start ssh-klm

Configuration Restore

# Restore configuration
sudo tar -xzf sshklm-config-backup.tar.gz -C /

# Verify configuration
sudo ssh-klm config validate

# Restart services
sudo systemctl restart ssh-klm

Full Disaster Recovery

1. Provision infrastructure (same or new)
2. Restore encryption keys to Vault/KMS
3. Restore database from backup
4. Restore configuration files
5. Re-register agents (if needed)
6. Verify connectivity and data integrity

Verification

# Test backup integrity
pg_restore --list /backup/sshklm-20260106.dump

# Verify database consistency
ssh-klm admin db:verify

Related Pages

• Monitoring
• Troubleshooting