How backups work
The agent usespg_dump piped through gzip to create compressed SQL dumps:
- Backups are triggered via the API or dashboard (async, returns immediately)
- Uses
asyncio.create_subprocess_exec(not shell) to prevent command injection - Only
PGPASSWORDandPATHare passed to the subprocess environment - If pg_dump fails, the incomplete file is deleted
Storage
Backups are stored locally on the VPS:Retention
The agent has adelete_old_backups(retention_days=7) method, but it’s not yet automated. Backups accumulate until manually cleaned.
To clean up manually:
Automating retention via cron or systemd timer is on the roadmap. S3 backup storage (for durability and download links) is also planned.