Backups and recovery

Configure the destination

The LSBS Backup module uses BorgBackup. Choose a local repository, an SSH repository, or the Hetzner Storage Box preset. SSH-based destinations use keys and pinned host trust; LSBS does not automate an SSH password.

For a Storage Box, use the assigned uXXXXX account and SSH port 23. Add the server’s backup public key to the Storage Box before the first run.

Choose the backup scope

Select business data explicitly. LSBS always adds a configuration backup and transactionally consistent operational PostgreSQL dumps; it never file-copies a live PostgreSQL data directory. When directory or groupware services are installed, their supported consistency exports are included by the module.

Encryption and retention

Use repository encryption unless another verified control protects the destination. Borg deduplication means each archive is presented as a complete backup while reusing unchanged blocks. Configure retention for the recovery history the business actually needs.

Verify recovery

A successful upload is not enough. LSBS runs a weekly Borg data check and restores a mandatory canary from the newest archive for byte-for-byte verification. Treat a missing or failed verification as an action item, and perform a real isolated restore test regularly.