Backup and restore

Regular backup of data and configuration, and restore from a copy of the same installation.

Deployment methodThe commands on this page apply to the Docker Compose delivery. Open the matching Kubernetes and Helm procedure.
Terms used in this guide
  • A reverse proxy accepts external requests and forwards them to MassAccess services.
  • Transport Layer Security (TLS) encrypts connections to the public address.
  • A health check confirms that a service is ready to handle requests.
  • Enrollment binds an installed instance to the created license.

Backup

The package includes backup.sh and restore.sh. Cold backup preserves owned application/transport volumes, private .env, metering/transport PKI, credentials, identities and exact release metadata. Archives (0600) and directory (0700) contain secrets; approved encryption is required outside the local private store.

Recommended schedule

Daily copies — at least the last 7 days; weekly — at least the last month; monthly — at least the last year.

Data storage volumes

Data is stored in the following volumes:

  • postgres_data
  • clickhouse_data
  • kafka_data
  • kafka_secrets
  • kafka_shared_config
  • redis_data
  • broker_data
  • receiver_state
  • agent_state

Do not store backups in Git, issues, CI artifacts or public directories.

Backup procedure

Ensure enough free space. Under the shared lock, the script stops Receiver admission, drains Agent and stops all writers before copying:

bash
bash backup.sh

For isolated restore, leave the source installation stopped. Record the private backup path, inventory and time; source volumes remain intact:

bash
bash backup.sh --leave-stopped

An ordinary backup resumes the previously running containers itself. Archive success does not prove restore; verify health separately:

Configure incoming MAX and Telegram messages for this installation. Once ingress is ready, reconnect the bot and verify delivery of a real message separately.

Restore

Restore is performed only from a backup of the same installation. Before starting, stop the application and make sure the copy is intact.

Restore procedure

Keep the source installation off. Preserve its private backup and failing/current state; do not delete source volumes.

bash
bash backup.sh --leave-stopped

From a trusted lifecycle package, restore into an empty directory and a new project. Existing volumes are not overwritten. Repeating the exact command resumes only the journal-bound operation with the same backup.

bash
mkdir -m 700 /srv/massaccess-restored
bash restore.sh --root /srv/massaccess-restored \
  --backup /secure/backup/offline-UTC-pid --project ms-onprem-restored

complete_offline does not start actors. Confirm source off, available host ports and standard license HW binding; then start the complete model and verify actual retained messages, idempotency, route receipts and application data.

bash
cd /srv/massaccess-restored
docker compose -p ms-onprem-restored --env-file .env \
  -f docker-compose.onprem.yml -f docker-compose.transport.yml up -d --pull never
python3 transport.py local-ready --timeout 300