Back Up and Retain Data
Repository scripts support Compose only. Kubernetes/external stores require operator tooling.
Bundle Scope
Section titled “Bundle Scope”backup.sh writes Postgres globals/database dumps, Redis AOF after rewrite, and available STS/Gateway replay state. It excludes secrets.
Backup Procedure
Section titled “Backup Procedure”CARACAL_BACKUP_DIR=/var/backups/caracal CARACAL_BACKUP_RETAIN=7 bash infra/scripts/backup.shSet the Compose project when non-default. Encrypt/copy off-host and back up matching secrets separately.
Verify Backup
Section titled “Verify Backup”Inspect manifest/dumps/AOF/replay, then restore with copied secrets into an isolated project and verify readiness, policy, sessions, revocation, authorization, and audit.
Restore Procedure
Section titled “Restore Procedure”CARACAL_COMPOSE_PROJECT=<isolated-project> CARACAL_RESTORE_CONFIRM=yes bash infra/scripts/restore.sh <bundle.tar.gz>Postgres/Redis containers and matching secrets must exist.
Recovery
Section titled “Recovery”On failure keep isolated, preserve output/state, recreate clean volumes, and retry from original bundle/secrets. Never reopen partial restore.
Next Step
Section titled “Next Step”Use Respond to Incidents after data loss or tampering.