Backup and recovery#
Back up the SQLite database, private configuration and any operator-managed experience data. Provider credentials should remain recoverable from the secret manager rather than depending on a server copy.
Before you start#
- An encrypted off-host backup destination.
- A maintenance window or a SQLite-safe backup method.
- The exact deployed source revision and dependency lock files.
Create a backup#
- Confirm no migration is running.
- Use the repository's backup script or a SQLite online-backup operation; do not copy an actively changing database with a generic file copy.
- Save the production environment file separately with restricted access.
- Record the application revision and database schema version.
- Encrypt the result and transfer it off the application host.
Verify#
Restore into a disposable environment with outbound telephony disabled. Start
the matching application revision, allow migrations only after taking another
copy, and verify calls, messages, number routing and operator settings. Confirm
that /api/ready reports the expected schema and that no live webhook URLs point
at the test restore.
Only replace production after the restore test passes. Retain the pre-restore database until the repaired service and a controlled call have been verified.
If it does not work#
| Symptom | Check | Recovery |
|---|---|---|
| The restored instance refuses to start | Whether the application revision matches the one that produced the backup | Start the matching revision first; migrating a mismatched schema loses the ability to retry |
| Migrations are needed on restore | Whether you took a second copy first | Take another copy before allowing migrations. A failed migration on your only copy is unrecoverable |
/api/ready reports an unexpected schema |
The revision, then the migration state | Do not migrate forward to make the error stop |
| The test restore starts calling out | Whether outbound telephony was disabled before starting it | Stop it immediately — a restore with live webhook URLs can answer real calls |
| Data is present but settings are missing | Whether configuration is inside the backup or outside it | Operator settings and the database are separate; confirm both are captured |