Backup & Recovery

Database backup, recovery key protection, and disaster recovery.

Database Backup

Automated Daily Backup

bash
#!/bin/bash
# /opt/BlueSentinel/backup.sh
BACKUP_DIR="/opt/BlueSentinel/backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR
pg_dump -U bluesentinel -d bluesentinel -F c -f "$BACKUP_DIR/bluesentinel_$TIMESTAMP.dump"

# Keep only last 30 days
find $BACKUP_DIR -name "*.dump" -mtime +30 -delete

Add to crontab:

bash
0 2 * * * /opt/BlueSentinel/backup.sh

Restore from Backup

bash
pg_restore -U bluesentinel -d bluesentinel -c bluesentinel_20260817_020000.dump

Recovery Key Protection

Recovery keys are critical — losing them means you cannot decrypt locked devices:

  • Back up the recovery_keys table separately
  • Store backups in an encrypted, offsite location
  • Test recovery key retrieval regularly

Application Backup

Back up these files:

  • /opt/BlueSentinel/.env — Environment configuration
  • /etc/systemd/system/bluesentinel.service — Service configuration
  • /etc/nginx/sites-available/bluesentinel — Nginx configuration
  • TLS certificates

Disaster Recovery

  1. Provision a new server
  2. Install PostgreSQL and restore the database backup
  3. Install BlueSentinel and restore configuration files
  4. Update DNS to point to the new server
  5. Agents will automatically reconnect on their next heartbeat cycle (within 60 seconds)

Agents are resilient to server outages. They continue enforcing policies in offline mode and queue alerts until the server is available again.