Protection plan

A protection plan is the decision on what to back up on a server and how: which databases, volumes and directories, by which method, how often and to which storages. Until the plan is confirmed, there are no backups.

Where it comes from

The agent scans the server and reports what it found. The panel suggests a plan based on the findings: recognized databases and application data are already checked, and a backup method is picked. You review it, change it and click “Confirm plan”.

After that the agent scans the server on its own — every 6 hours by default — and when you click “Discover now” on the “Protection settings” tab. Discovery only reads: it changes nothing on the server and doesn't read password values, only their names.

Where to open it

• a new server — “Confirm plan” in the server's row;
• a server with a plan — the “Protection settings” tab → “Edit plan”;
• from the “Not in the backup” block on the server overview — “Decide in the protection plan”.

What's on the plan page

At the bottom is the summary — “In backup: 12 of 15, ≈ 48 GB · standard · to Primary and Secondary” — and the “Confirm plan” or “Save plan” button.

Application data

Each row has a checkbox, a size, the method in the “How to copy” column and a “Why” button: what signs the agent used to find it and which method it suggests. What the methods mean — Backup methods.

• The “assumed” and “not identified” labels show how sure the agent is. “Assumed” means it was recognized only by the container image.
• Nested directories are shown as a tree. A nested one is copied in its own row; if you uncheck it, it's also left out of the parent's copy.
• Logs and cache are unchecked by default: “usually not needed”.
• A resource without a suitable method shows “no adapter: don't protect, or copy as files”. If you check it, it will be a file copy of a live database — not consistent.
• For Vault you can choose “file copy” or “Vault snapshot (raft)”.

Needs a decision

This is where things go that the agent can't decide on by itself:

For each item, there's a choice:

• “decide later” — not in the backup; the server keeps a warning, for example “Volume uploads is not in the backup”;
• “protect — file copy” — goes into the backup as a file copy, not consistent. Available for named volumes and directories;
• “don't protect” — with an optional reason. The server's warning goes away; the item stays in “Not in the backup” with your reason.

A stopped container and external data can only be marked “don't protect”. They don't give the server a warning, but they're shown in “Not in the backup”. For several items of one group, there are “for all:” buttons.

For a database volume, a file copy is a last resort: it's more reliable to have the agent recognize the service and dump the database.

When discovery finds a new unrecognized volume or directory on a server with a plan, it lands here, the server gets a warning, and a “New and unprotected” notification is sent.

New

The “new” label means the resource appeared on the server after the last saved plan: it's neither in the plan nor among the excluded. For example, you launched a new project with its own database.

• New items that have a backup method are already checked — as in the first plan. Logs, cache and resources without a method aren't checked.
• New items go into the backup only after “Save plan”. Until then the agent works by the previous plan.
• Above the plan is a summary: “On the server since the last plan: 2 new, 1 gone, 0 changed.”

While a new item isn't in the plan, the server has the warning “… — new, not in the protection plan”, and the notification comes once: “found and not protected — … (new since the plan)”. More — Server statuses.

Gone from the server

The resource is in the plan, but the agent no longer finds it: the volume was deleted, the directory moved, the container removed. There's nothing to copy.

When the plan is saved, such resources leave it on their own. Until the plan is saved, the agent tries to copy them, and errors show up in the server log, for example “Not on the server: /srv/old”. Open the plan and click “Save plan”.

Not protected

An unchecked box means “not protected”. You can write a reason in the field next to it; for a group — the “don't protect” button and one reason for all unchecked items. The reason is kept in the plan and shown on the plan page in the resource's row.

On the server overview, the “Not in the backup” block shows:

• “no dump” — a required component didn't make it into the latest backup, for example pg_dump failed. This isn't your decision but a failure: the server is “Critical”;
• items from “Needs a decision” not decided yet — with a hint and the time they were found;
• items from “Needs a decision” marked “don't protect” — with your reason.

If it's empty — “Everything the agent found is in the backup.”

Revisions

Each save is a new plan revision: “revision 3” in the plan page header. An unconfirmed plan shows “suggested from what was found” there.

• The agent gets the new revision on its next check-in, usually within a minute, and keeps it locally. If the panel is unavailable, it works by the last accepted one.
• A backup that is already running finishes by its own revision. The new one applies from the next run.
• Other changes create a new revision too: upload settings for a storage, a change of a storage's key or key mode. And the panel itself — when the agent has learned a new backup method: the log shows “the agent learned consistent methods: …”.
• If the plan was changed in another tab, saving fails: “The plan was changed in another tab — reopen the page.”

Agent on the server

• Discovery — how often the agent scans the server: every hour, every 6 hours or once a day.
• Staging — space on the server's disk for database dumps and host settings waiting to be sent. 40 GB by default, at least 1 GB. restic reads directories and volumes straight from disk; they aren't in staging. Sets are deleted automatically once sent to all storages.