backup-recovery

name	backup-recovery
description	Backup and disaster recovery planning and implementation for enterprise systems
license	MIT
compatibility	opencode
metadata	{"audience":"system-administrators","category":"systems-administration"}

What I do

• Design backup strategies and policies
• Implement backup solutions (Veeam, Bacula, rsync, Restic)
• Create disaster recovery plans
• Test backup restores regularly
• Manage replication and snapshots
• Coordinate failover procedures
• Document recovery procedures
• Optimize backup windows
• Implement backup encryption
• Monitor backup success and integrity

When to use me

When designing backup strategies, implementing disaster recovery procedures, or troubleshooting backup failures.

Core Concepts

• Backup types (full, incremental, differential)
• RPO (Recovery Point Objective) and RTO (Recovery Time Objective)
• Backup media and storage strategies
• Replication and failover clustering
• Snapshot management
• Backup encryption and security
• Disaster recovery testing
• Cloud backup solutions
• Database backup strategies
• Bare-metal recovery procedures

Code Examples

Backup Scripts

#!/bin/bash
set -euo pipefail

# Configuration
readonly BACKUP_BASE="/backup"
readonly RETENTION_DAYS=30
readonly ENCRYPTION_KEY_FILE="/etc/backup/encryption.key"
readonly LOG_FILE="/var/log/backup.log"
readonly NOTIFICATION_EMAIL="[e-mail]"

# Logging
log() {
    local level="$1"
    shift
    local message="$@"
    echo "[$(date '+%Y-%m-%d %H:%M:%S')] [$level] $message" | tee -a "$LOG_FILE"
}

log "INFO" "=== Backup started ==="

# Database backup function
backup_database() {
    local db_type="$1"
    local db_host="$2"
    local db_name="$3"
    local backup_path="$4"
    local timestamp=$(date +%Y%m%d_%H%M%S)
    
    log "INFO" "Backing up database: "
    
      
        postgresql)
             backup_file=
            
            
            PGPASSWORD= pg_dump -h  -U   | \
                gzip | \
                openssl enc -aes-256-cbc -salt -pbkdf2 \
                    -pass file: \
                    -out 
            
            
             openssl enc -d -aes-256-cbc -pbkdf2 \
                -pass file: \
                -  | gzip -d > /dev/null; 
                 size=$( -h  |  -f1)
                  
                
                
                  > 
                  
            
                  
                 1
            
            ;;
            
        mysql)
             backup_file=
            
            mysqldump -h  -u  -p \
                --single-transaction --quick  | \
                openssl enc -aes-256-cbc -salt -pbkdf2 \
                    -pass file: \
                    -out 
            ;;
    
    
    
     600 
}


() {
     source_path=
     dest_path=
     backup_name=
     timestamp=$( +%Y%m%d_%H%M%S)
    
      
    
    
     -p 
    
    
    rsync -av --delete \
        --link-dest= \
         \
        
    
    
     -f 
     -s  
    
      
}


() {
     backup_name=
     included_namespaces=
     excluded_namespaces=
    
      
    
    
    velero backup create  \
        --include-namespaces  \
        --exclude-namespaces  \
        --snapshot-volumes \
        --
    
    
    velero backup describe  --details
    velero backup logs  |  -20
}


() {
     backup_path=
     max_age_days=
    
      
    
    
     deleted=0
     IFS=  -r -d  backup; 
         -rf 
        ((deleted++))
          
     < <(find  -maxdepth 1 - d -name  -mtime + -print0)
    
      
}


() {
      
    
     checks_passed=0
     checks_failed=0
    
    
     [ -d  ]; 
          
        ((checks_passed++))
    
          
        ((checks_failed++))
    
    
    
     latest_backup=$(find  -maxdepth 2 - d -name  -  2>/dev/null |  -r |  -1 |  -d -f2-)
     [ -n  ]; 
         backup_age=$(find  -maxdepth 1 - f -  2>/dev/null |  -1)
          
        ((checks_passed++))
    
          
        ((checks_failed++))
    
    
    
     [ -f  ]; 
        ((checks_passed++))
    
          
        ((checks_failed++))
    
    
    
      
    
     [  -gt 0 ]; 
          | mail -s  
         1
    
}


() {
     action=
    
      
        database)
            backup_database    
            ;;
        filesystem)
            backup_filesystem   
            ;;
        kubernetes)
            backup_kubernetes 
            ;;
        retention)
            enforce_retention 
            ;;
        health)
            backup_health_check
            ;;
        all|*)
            backup_database    
            backup_filesystem   
            backup_kubernetes 
            enforce_retention 
            backup_health_check
            ;;
    
    
      
}

main 

Disaster Recovery Plan

# Disaster Recovery Plan

## Executive Summary
- **RPO**: 4 hours (max data loss)
- **RTO**: 8 hours (max downtime)
- **Recovery Sites**: Primary (AWS us-east-1), DR (AWS us-west-2)

## Critical Systems
| System | RTO | RPO | Priority |
|--------|-----|-----|----------|
| Database | 2h | 15min | P0 |
| Application | 4h | 1h | P1 |
| File Storage | 8h | 4h | P2 |

## Recovery Procedures

### 1. Database Recovery (PostgreSQL)
```bash
#!/bin/bash
# Emergency DB recovery script

# Variables
BACKUP_PATH="/dr-backup/postgresql"
LATEST_BACKUP=$(ls -td "$BACKUP_PATH"/*/ | head -1)
TARGET_HOST="dr-db.example.com"

# Stop application
kubectl scale deployment/app --replicas=0 -n production

# Restore database
ssh "$TARGET_HOST" "sudo systemctl stop postgresql"
scp "$LATEST_BACKUP"/*.enc "$TARGET_HOST:/tmp/"
ssh "$TARGET_HOST" "
    cd /tmp
    for file in *.enc; do
        openssl enc -d -aes-256-cbc -pbkdf2 \
            -pass file:/etc/backup/encryption.key \
            -in \"\$file\" -out \"\${file%.enc}\" 2>/dev/null || true
    done
    find /tmp -name '*.sql' -exec psql -U postgres -d app_production {} \;
"
ssh "$TARGET_HOST" "sudo systemctl start postgresql"

# Verify
psql -h "$TARGET_HOST" -U postgres -d app_production -c \"SELECT COUNT(*) FROM users;\"

2. Application Recovery

#!/bin/bash
# Emergency application recovery

# Update kubeconfig to DR cluster
export KUBECONFIG=/etc/kubernetes/dr-kubeconfig

# Verify cluster health
kubectl get nodes
kubectl get pods -n production

# Restore ConfigMaps and Secrets
kubectl apply -f /dr-backup/k8s/configmaps/
kubectl apply -f /dr-backup/k8s/secrets/

# Deploy applications
kubectl apply -f /dr-backup/k8s/deployments/

# Scale up
kubectl scale deployment/app --replicas=3 -n production

# Verify
kubectl rollout status deployment/app -n production
kubectl get svc -n production

3. DNS Failover

#!/bin/bash
# Update DNS for failover

# Get DR site IPs
DR_LB=$(aws elb describe-load-balancers \
    --load-balancer-names app-dr \
    --query 'LoadBalancers[0].DNSName' \
    --output text)

# Update Route53
aws route53 change-resource-record-sets \
    --hosted-zone-id ZXXXXXXXXXXXXX \
    --change-batch file://<(cat <<EOF
{
  "Changes": [{
    "Action": "UPSERT",
    "ResourceRecordSet": {
      "Name": "app.example.com",
      "Type": "CNAME",
      "TTL": 60,
      "ResourceRecords": [{ "Value": "$DR_LB" }]
    }
  }]
}
EOF
)

echo "DNS updated to point to DR site"

Testing Schedule

• Weekly: Backup verification
• Monthly: Database restore test
• Quarterly: Full DR simulation

Contacts

Role	Name	Phone	Email
DR Coordinator	John Smith	[phone]	[e-mail]
DBA	Jane Doe	[phone]	[e-mail]

## Best Practices
- Follow 3-2-1 backup rule: 3 copies, 2 media types, 1 offsite
- Test restores regularly, not just backups
- Document recovery procedures and keep them updated
- Automate backup verification checksums
- Use encryption for sensitive data at rest and in transit
- Maintain clear RPO/RTO definitions for each system
- Implement monitoring for backup jobs and success rates
- Use source-controlled backup configurations
- Regular DR testing and documentation of findings
- Maintain offline/offsite backup copies for ransomware protection