Everyday use
The schedule, how long backups are kept, alerts, getting data back, and how the Backup Server updates itself.
On this page
Once an install is connected, the Backup Server runs by itself. This page is for looking in on it, changing the odd setting and getting data back.
Checking on it#
Sign in to the panel over the VPN. The Overview page shows every source at a glance: what needs attention, what's up to date, and the state of the vault and the VPN.
From a terminal on the Backup Server, two commands cover most questions:
sudo librebackup status
sudo librebackup schedule show
status lists the last backup of every source and says OK or STALE. A source is stale when its newest snapshot is older than 36 hours, or it has none. schedule show lists each source's time, its next run, its last good backup and its last result.
The schedule#
Every source is backed up every night at 02:00, plus a moment of its own within the following hour, so that sources take turns. Backups never run two at once. A backup that fails is tried twice more, 30 minutes apart, and you get an alert.
To change one source, open it in the panel and go to its Schedule tab. Set the Time and how long to Spread over, then press Save schedule. The time is the Backup Server's own clock, which the tab names. Back up now on the source's page runs one straight away.
From the terminal:
sudo librebackup schedule set NAME --time 03:30 --window 30
sudo librebackup schedule set NAME --off
sudo librebackup backup NAME
--off stops the nightly run for that source. Back up now still works.
How long backups are kept#
Your install decides. Its own retention rules are sent to the Backup Server with every backup, so a change you make on the install reaches the Backup Server at its next pull. The source's Schedule tab shows them, and the Retention card there is read only.
Until an install has sent any, a safe default applies: 7 daily, 4 weekly and 6 monthly snapshots. The Backup Server then tidies away what falls outside them.
Three things are never tidied away, whatever the rules say:
- the newest 3 good snapshots of every app and folder;
- the newest 5 snapshots older than 30 days, as a safety net;
- anything belonging to a source that is on hold (see below).
When a backup looks wrong#
A backup can't be trusted just because it arrived. If a pull has far fewer bytes or files than the last good one, more than half fewer by default, the Backup Server puts that source on hold. It still keeps the snapshot, but it stops pruning that source and raises an alert.
That might mean the install lost data, or was tampered with. If the smaller size is real, for example because you deleted a lot on purpose, tell the Backup Server it's fine:
sudo librebackup guard accept NAME
If the next backup comes back within the normal range, the hold lifts by itself.
Each source also has a size limit, 100 GB by default, so a runaway one can't crowd out the others. At its limit a source is refused, and you get an alert. Raise the limit on the source's Backups tab, or with sudo librebackup quota set NAME 200 (in GB).
Alerts on your phone#
The Backup Server sends its messages to ntfy, the same way LibrePortal's notifications do. In the panel, open Server → Notifications and add a target: an ntfy server address, a topic and, if your topic needs one, an access token. Press Test to check that a message arrives.
Each source chooses on its Alerts tab which targets it reports to. You get a high-priority message the moment something is wrong, such as a missed backup, a refused pull, a disk nearly full or a backup that is suddenly much smaller than usual. You also get one short summary a day. Messages never include passwords, paths or addresses.
Getting data back#
You restore from the install. The Backup Server never writes to it.
- On the install, open Admin → Backups → Locations. Once it's connected, the Backup Server card shows, with a Restore from your Backup Server button. Press it.
- Pick a backup from the list of runs.
- Choose what to restore: Everything, one app, or one shared folder.
- Press Restore and confirm. It runs as a task, which you can follow on the Tasks page.
An app is restored in place: it's stopped, its folder is replaced, its database is loaded from the saved copy and it's started again. A shared folder comes back in a new folder named Restored and the date, inside the shared folder, so nothing that's there is changed.
Restoring an app replaces what's there now
Anything an app changed after that backup is lost when you restore it. If you're unsure, press Backup now on the app first.
Advanced Restore from the install's terminal
To see what the Backup Server holds, then restore from it:
sudo -u libreportal libreportal backupserver snapshots
sudo -u libreportal libreportal backupserver restore latest app:NAME
The second word is a backup run or latest. The last is app:NAME, shared:KIND or everything.
New to the command line? How to run LibrePortal commands →
If the install itself is gone, install LibrePortal on a new machine, connect it to the Backup Server again from Connect to a Backup Server, and restore from there. Your backups on the Backup Server are kept.
Try a restore before you need one#
The best time to learn that a restore works is while nothing is wrong. Pick something you can afford to be wrong about:
- A shared folder is the gentlest, if you have one. It comes back into a new Restored folder and changes nothing that's there. Open it and see that your files are in it.
- An app you can spare, such as one you don't use every day. Restore it, open it and check your data is there.
On the Backup Server, sudo librebackup vault check is a quick extra check. With the vault unlocked, it says whether each stored password still opens its repository.
Advanced Get a single file back by hand
You can also take a file out of a snapshot on the Backup Server itself with restic. Paste the source's password so that it never goes in a file or on a command line.
sudo librebackup vault unlock
sudo librebackup vault show-history NAME --reveal
read -rs RESTIC_PASSWORD && export RESTIC_PASSWORD
timeout 120 restic -r /var/lib/backupsink/data/NAME snapshots
restic -r /var/lib/backupsink/data/NAME restore latest --target /root/restore-NAME --include /var/lib/backupsink/staging/NAME/PATH
unset RESTIC_PASSWORD
sudo librebackup vault lock
show-history --reveal asks for the master password and prints each stored password. Copy the one whose retired column says current. Run the restic commands as root, in a shell where RESTIC_PASSWORD is set. Paths inside a snapshot begin with /var/lib/backupsink/staging/NAME/. Restore into an empty folder, check the files, then move them where they belong.
New to the command line? How to run LibrePortal commands →
Updates#
The Backup Server updates itself from signed releases, every day at 12:30 server time by default, because that's quiet: backups run at night. It only installs a release whose signature and checksum both check out, never while a backup is running, and puts the old version back if the update fails. You'll get an ntfy message either way.
You can change the time, switch it off, or update by hand in the panel on Server → Settings, under Updates. The Update button there installs a newer version straight away. Or from the terminal:
sudo librebackup update --check
sudo librebackup update
sudo librebackup update-auto --status
sudo librebackup update-auto --time 04:00
sudo librebackup update-auto --set off
update --check only looks. Updates keep your keys, VPN devices, settings, vault and sources.