feat(ops): instance backup + restore scripts #76

Merged

raisondetredev merged 2 commits from feat/instance-backup-scripts into main

2026-07-05 23:23:27 +02:00

raisondetredev commented

2026-07-05 23:21:10 +02:00

(Migrated from codeberg.org)

What

Operator disaster-recovery scripts for a self-hosted Supabase instance (run on the host that runs it):

scripts/backup-instance.sh — writes a dated backups/halkyon-<date>/ directory containing:
- db-<date>.sql.gz — pg_dumpall: the whole cluster + roles/globals (public app data + reference tables, auth, storage metadata, RLS/RPCs/triggers/publication).
- storage-<date>.tar.gz — the Storage object bytes for every bucket, including the per-user backups bucket.
- config/ — supabase/config.toml + any .env (secrets).
- MANIFEST.txt — timestamp, container names, infra git commit, file sizes.
scripts/restore-instance.sh — replays a backup into a fresh instance (typed restore confirmation; re-extracts the storage volume). Config/secrets aren't auto-applied — the instance must come up with the same JWT secret or existing tokens + the app's anon key stop validating.

Notes

This is the instance backup (whole Postgres + Storage bytes + config) — distinct from the app's per-user backups bucket (in-app content rollback), which lives on the same instance and is captured by the storage step.
Container names auto-detect (supabase_db* / supabase_storage*) with env overrides; both scripts bash -n-clean and executable.
.gitignore keeps dumps / tarballs / secrets out of the repo; scripts/README.md documents usage + restore caveats.

## What Operator disaster-recovery scripts for a self-hosted Supabase instance (run on the host that runs it): - **`scripts/backup-instance.sh`** — writes a dated `backups/halkyon-<date>/` directory containing: - `db-<date>.sql.gz` — `pg_dumpall`: the whole cluster + roles/globals (public app data + reference tables, `auth`, `storage` metadata, RLS/RPCs/triggers/publication). - `storage-<date>.tar.gz` — the Storage object **bytes** for every bucket, including the per-user `backups` bucket. - `config/` — `supabase/config.toml` + any `.env` (secrets). - `MANIFEST.txt` — timestamp, container names, infra git commit, file sizes. - **`scripts/restore-instance.sh`** — replays a backup into a **fresh** instance (typed `restore` confirmation; re-extracts the storage volume). Config/secrets aren't auto-applied — the instance must come up with the **same JWT secret** or existing tokens + the app's anon key stop validating. ## Notes - This is the **instance** backup (whole Postgres + Storage bytes + config) — distinct from the app's per-user `backups` bucket (in-app content rollback), which lives on the same instance and is captured by the storage step. - Container names **auto-detect** (`supabase_db*` / `supabase_storage*`) with env overrides; both scripts `bash -n`-clean and executable. - `.gitignore` keeps dumps / tarballs / secrets out of the repo; `scripts/README.md` documents usage + restore caveats.