Backups & Disaster Recovery¶

What's in a backup¶

Each run of scripts/backup-onprem.sh produces a single timestamped archive, itsm_backup_YYYYMMDD_HHMMSS.tar.gz, containing:

PostgreSQL dump — tickets, assets, users, audit trail
Uploaded media — attachments, knowledge-base images, asset files
System config — backend/.env, license.key, and (if encryption is active) ENV_MASTER_KEY_FILE

The master key is what makes an encrypted backup usable

If DB password encryption is set up, backend/.env contains DB_PASSWORD_ENC instead of the plaintext password. Without the master key, that value — and therefore the backup — cannot be turned back into a working install. backup-onprem.sh/restore-onprem.sh already carry the key file automatically; if you ever back up manually, always include it alongside .env.

Target SLAs¶

Metric	Target	Description
RPO (Recovery Point Objective)	24 hours (default)	Max data loss window with daily automated backups
RTO (Recovery Time Objective)	< 15 minutes	Time to restore full app + database
Backup retention	30 days (configurable)	Older archives are purged automatically

Setting up automated nightly backups¶

Test manually first:

./scripts/backup-onprem.sh

Then add a crontab entry for midnight:

crontab -e

0 0 * * * /path/to/service-mgmt-application/scripts/backup-onprem.sh >> /var/log/itsm-backup.log 2>&1

Disaster recovery¶

Copy the archive to the target server:

scp /var/backups/itsm_backup_20260730_000000.tar.gz admin@target-server:/path/to/repo/

Run the restore script:
```
./scripts/restore-onprem.sh ./itsm_backup_20260730_000000.tar.gz
```
This restores the Postgres schema/data (pg_restore), uploaded files into backend/uploads/, and .env/license.key (plus the master key file, if the backup carried one).

Restart application services:

pm2 restart all                                         # native/PM2
docker compose -f docker-compose.prod.yml restart        # Docker

Offsite backups & encryption at rest¶

Offsite-copy /path/to/backups/*.tar.gz via rsync or an S3 tool to NAS/cloud storage. Encrypt the archive itself before shipping it offsite:

gpg -c /path/to/backups/itsm_backup_20260730_000000.tar.gz