Lumekara
IDEN
All projects
DevOps

Daily Backups and Restore Drills

The database is backed up daily, encrypted, to separate storage, and the restore procedure has been tested in restore drills.

Status
Live
Layers
DevOpsAutomation
Used by
Numekara's owner, who needs to know student, order, and payment data can be brought back if something goes wrong.
Ask about this project

The problem

Many businesses only discover their backups are broken or incomplete when data is already lost.

The solution

A daily workflow dumps the database, encrypts it, writes a checksum, and ships it to separate storage. The restore-drill script refuses to run against production, and drill results are recorded as evidence.

How it works

What happens, step by step, from the user's point of view.

  1. 01

    Backups run every night

    GitHub Actions copies the whole database on a daily schedule. It doesn't depend on anyone's laptop.

  2. 02

    The copy is checked

    Before it is stored, the copy's structure is checked so an empty or broken backup can't slip through.

  3. 03

    Locked and given a checksum

    The copy is encrypted with a secret passphrase, then given a checksum that reveals if the file changes or gets damaged.

  4. 04

    Stored somewhere separate

    The file is sent to Cloudflare R2, outside the database provider. Copies past their retention period are removed automatically.

  5. 05

    Restores are actually rehearsed

    The drill script downloads the latest backup, verifies the checksum, decrypts it, and restores it into a test database. It refuses to run against production.

  6. 06

    Drill results are written down

    Every drill is logged as PASS or FAIL, failures and fixes included. The latest drill passed after one script fix.

System design

Who uses it, what they see, what works behind the scenes, and where the data lives. Read it from left to right.

  1. 1Data source

    • Production databasePostgreSQL on Supabase holding student, order, and payment data

  2. 2What runs automatically

    • GitHub Actions scheduleRuns the backup every day without anyone starting it
    • Backup scriptCopies, checks, encrypts, and writes a checksum

  3. 3Separate storage

    • Cloudflare R2Keeps encrypted backup files outside the database provider

  4. 4Restore drill

    • Drill scriptRestores the latest backup into a test database, never production
    • Test databaseA temporary place to prove the data opens again

  5. 5Proof for the owner

    • Drill logA document with the PASS or FAIL result of each drill
    • System pageShows backup status in the admin dashboard

Key features

  • Scheduled daily backups
  • Encryption and checksums
  • Off-server storage
  • Documented restore drills
  • Production database safeguard

Built with

  • PostgreSQL
  • GPG
  • GitHub Actions
  • Cloudflare R2
  • Bash

What the business gets

  • Business data has a daily copy outside the main provider.
  • There is written proof that backups can actually be restored, not just created.
  • Backup files can't be read without the encryption passphrase.
  • A backup that doesn't run is flagged as failed straight away, not hidden behind a green tick.

Terms on this page

Backup
A spare copy of your data kept elsewhere, used if the original is damaged or lost.
Checksum
A file's fingerprint; if even a small part changes, the fingerprint no longer matches.
Cloudflare R2
Cloudflare's online file storage, used here to hold the backups.
GitHub Actions
A GitHub service that runs automatic jobs on a schedule, like an alarm that does the work itself.

Can it work for your business?

Data protection every business app needs, with proof that the data can actually be restored.

Ask about this project