Operator Guide

Recovery Snapshots

Create encrypted recovery points, prove that they decrypt and match every recorded hash, move them off the VPS, and restore them with a verified rollback.

Three independent resilience layers

Availability, recent redundancy, and disaster recovery solve different problems and must not be treated as interchangeable.

1. Live service

The holder serves requests. In HA, either VPS may hold the writer lease.

2. Peer recovery point

A recent accepted complete bundle supports failover after one VPS is lost.

3. External recovery copy

An independently encrypted and verified snapshot protects against both VPSs, corruption, and operator mistakes.

HA can rapidly copy a bad change to the peer. Only an older independent recovery point lets an operator return to an earlier known-good state.

Snapshot contents

Database: a PostgreSQL custom-format dump.
Configuration and secrets: protected shared configuration without node-local HA credentials.
Complete recovery: database, shared configuration, secrets and the applicable proxy topology metadata.

Each v2 snapshot directory contains an age-encrypted archive, an outer SHA-256 file and a public receipt. Inside the ciphertext, a manifest records every payload path, byte count, mode and SHA-256. Database dumps are also checked with pg_restore --list.

Create and deep-verify

MP-OPT

Open Snapshots and recovery.
Select Create a named complete recovery snapshot.
Give it a short, meaningful name.
Select Deep-verify a snapshot with the operator-held identity.
Select that exact snapshot and paste the matching AGE-SECRET-KEY-1... only into the hidden prompt.

Accept it only when MP-OPT confirms the outer archive hash, successful decryption, key ID, every manifest hash/size/mode and the PostgreSQL catalogue. The private identity is held in a protected temporary file and removed after the operation.

Export a portable workstation copy

MP-OPT

Select Snapshots and recovery → Export one portable snapshot to a workstation, choose the verified snapshot, then choose the command style for Windows Command Prompt, PowerShell, Linux, macOS or generic SFTP.

Workstation

Run the generated transfer block in the directory where the file should be kept. For the supported command styles, accept only the final marker MP-OPT SNAPSHOT VERIFIED.

MP-OPT

Confirm the transfer only after the marker appears. MP-OPT records the portable package SHA-256 and confirmation time, then removes its temporary export.

The resulting .mpopt-snapshot remains encrypted. Keep two protected copies of the package and two separately protected copies of the private identity.

Import and restore

MP-OPT

Select Import one portable snapshot from a workstation. MP-OPT creates a random upload ticket and displays the exact upload destination.

Workstation

Run the generated upload command, then return to MP-OPT and provide the original package SHA-256 when requested.

Import rejects oversized packages, traversal, links, devices, duplicate members, invalid modes, hash mismatches, unsupported receipts and conflicting snapshot directories. It does not decrypt the archive.

Deep-verify the imported snapshot with its matching private identity.
In HA, confirm this node is the current holder and disable automatic failover.
Select Restore a verified snapshot with rollback protection.
MP-OPT creates and deep-verifies a fresh complete pre-restore snapshot.
Enter the exact phrase RESTORE SNAPSHOT.
After health passes, create and export a new baseline and send a fresh peer replication.

Security effects of database restore

A restore revokes replayed sessions, exchange codes, incomplete passkey ceremonies, activation/reset links and public schedule links. Desktop publishing secrets are invalidated and must be regenerated. Registered passkeys remain valid when the original application hostname is retained.

Related guides

Read Recovery Encryption Keys before creating the first archive and Disaster Recovery before testing a full rebuild.