Connecting a backup storage server
How to connect your own SSH server where the tracker will store encrypted backups.
The tracker stores backups on a separate server of yours, which it connects to over SSH. You add the server on the Settings → Backups («Настройки → Резервные копии») tab: you will need the IP, port, login, folder and a password or SSH key. Before the first server is connected, a backup encryption key is created. Why you need separate storage is explained in Backups: getting started.
Who can connect a server
Owners and admins can see the Backups tab. Only the installation owner can connect and disconnect servers — the owner account with the login set when the tracker was installed, in the first-run wizard. You must log in with your login and password: the section is closed in Log in as mode and to API tokens. Everyone else sees the message “Backups are available only to the installation owner” («Резервные копии доступны только владельцу установки»).
Storage server requirements
- A public IP address. A domain name, a local network address and
127.0.0.1are not accepted. - SSH access with SFTP support.
- A user who can create folders and files at the specified path.
- No symbolic links in the folder path.
You can connect up to 10 servers. On the eleventh, the tracker responds “You can connect up to 10 servers” («Можно подключить до 10 серверов»).
Encryption key first
A new storage server can be connected only after a backup encryption key has been created and confirmed. While encryption is not enabled, the + Storage server («+ Сервер хранения») button opens the key window with the line “Create an encryption key first — it takes a minute.” («Сначала создайте ключ шифрования — это займёт минуту.») If the key on the server is damaged, the same button opens the key replacement window with the line “The encryption key on the server is damaged. Backups are not being created. Replace the key.” («Ключ шифрования на сервере повреждён. Копии не создаются. Замените ключ.»)
- Create the key and confirm it with the file — see Creating the key.
- In the last window, click Connect storage server («Подключить сервер хранения»). The “Backup server” («Сервер для резервных копий») window opens.
While there is neither a key nor any servers, the Storage servers («Серверы хранения») block shows the hint “Step 1 — create an encryption key. Step 2 — connect a storage server.” («Шаг 1 — создайте ключ шифрования. Шаг 2 — подключите сервер хранения.»)
Fields of the “Backup server” window
| Field | What to enter | Rules |
|---|---|---|
| Name («Название») | A name by which you will recognize the server in the list | Required. Up to 100 bytes: 100 Latin characters or 50 Cyrillic ones |
| Server IP («IP сервера») | The storage server address, for example 203.0.113.10 | Public IP only |
| SSH port («Порт SSH») | The SSH port on the storage server | Default 22, from 1 to 65535 |
| Login («Логин») | The user on the storage server | Required. Up to 64 bytes: 64 Latin characters |
| Folder on the server («Папка на сервере») | The folder in which the tracker will create the tracker-backups folder | Default /backups. A full path starting with /, but not / itself. No . and .. parts, no double / and no trailing /. Up to 512 bytes |
| Login method («Способ входа») | SSH key («SSH-ключ») or Password («Пароль») | Default SSH key |
| Private SSH key («Приватный SSH-ключ») | The full text of the private key | Required for key login |
| Key passphrase, if set («Пароль ключа, если установлен») | The password that protects the key | Fill in if the key is protected with a password |
| Password | The user's password on the storage server | Required for password login |
| Create backups on a schedule («Создавать копии по расписанию») | Backups every day, once a week, once a month or once every 3 months at the chosen time | Off by default |
The tracker checks the first five fields when you click Check SSH server («Проверить SSH-сервер»). If a value does not meet the rules, a message appears at the bottom of the window: “Enter the server's public IP” («Укажите публичный IP сервера»), “Check the port and login” («Проверьте порт и логин») or “Enter a name and an absolute folder, for example /backups” («Укажите название и абсолютную папку, например /backups»).
Connecting the server
- Open Settings → Backups.
- Click + Storage server. If the encryption key window opens, create the key first.
- Fill in Name, Server IP, SSH port, Login and Folder on the server.
- Click Check SSH server. The tracker connects to the server and shows its fingerprint like
SHA256:…under the button. The password and key are not sent at this step. - Compare the fingerprint with your server's fingerprint.
- Select I confirm this server's fingerprint («Подтверждаю отпечаток этого сервера»).
- Choose the Login method.
- Paste the Private SSH key or enter the Password. If the key is protected with a password, fill in Key passphrase, if set.
- Click Connect server («Подключить сервер»). While the tracker checks access, the button says “Checking access…” («Проверка доступа…»).
The Connect server button is active when the fingerprint is confirmed and a key or password is entered. After connecting, the server appears in the Storage servers list; without a schedule it has the “Manual creation” («Ручное создание») label.
Changing any of the five fields from step 3 resets the fingerprint: click Check SSH server and confirm it again. When you change the login method, the entered password and key are cleared.
Scheduled backups
Before clicking Connect server, select Create backups on a schedule, fill in How often («Как часто»), Start time («Время запуска») and Time zone («Часовой пояс») and select I allow traffic to be stopped on schedule («Разрешаю остановку трафика по расписанию») — without this checkbox, the Connect server button is inactive. For a connected server, the schedule is turned on, changed and turned off with the Schedule («Расписание») button in the server's row. The fields, schedule rules and the traffic pause are covered on the Creating a backup and the schedule page.
What the tracker does when connecting
The tracker logs in to the server with your key or password and creates the missing folders of the path and the tracker-backups folder in the specified folder. It then writes a test file there and deletes it right away. Backups are stored in tracker-backups: with the /backups folder, this is /backups/tracker-backups.
The fingerprint is pinned to the server: on every connection, the tracker checks it before sending the password or key. If the fingerprint has changed, the tracker does not connect. To confirm a new fingerprint, disconnect the server and connect it again.
How credentials and backups are stored
The password and private key are stored on the tracker server in encrypted form. The panel does not show them, and they cannot be changed for a connected server.
When encryption is enabled, every new backup on the storage server is encrypted: its folder contains the snapshot.age file and a signed index.json. A backup can be read only with the key file — see What is stored on the storage server. Do not keep the key file on the storage server.
If a storage server is connected but encryption is not enabled yet, backups are stored on it unencrypted. Each such backup contains the data of all workspaces and the server configuration files with the installation keys. The server's row shows the “unencrypted” («без шифрования») label, and the top of the tab shows the “Backups are not encrypted” («Копии не зашифрованы») banner with the Enable encryption («Включить шифрование») button.
Checking the result
- Find the server in the Storage servers list. Under the name are the login, IP, port and folder, for example
[email protected]:22 · /backups. - Click Backups and restore («Копии и восстановление»). The Backups · server name («Копии · название сервера») block opens. While there are no backups in the folder, it says “No completed backups yet.” («Завершённых копий пока нет.»)
Next, create the first backup — see Creating a backup and the schedule.
Disconnecting a server
- Click Disconnect («Отключить») in the server's row.
- Confirm the prompt “Disconnect ‘…’? Backups already created will remain on the server.” («Отключить «…»? Уже созданные копии останутся на сервере.»)
The server disappears from the list, and scheduled backups are no longer created on it. The tracker does not delete the archives on the storage server.
The address, folder and login details of a connected server cannot be edited: to change the address, folder, SSH key or password, disconnect the server and connect it again. You can change the schedule without disconnecting, using the Schedule button. Previous backups in the same folder will get the “external backup” («внешняя копия») label, and pinning and the retention rule have to be set again — see Backup retention, pinning and cleanup.
A server can be connected again only with encryption enabled. In an installation where backups are not encrypted yet, keep this in mind before disconnecting a server: you will be able to bring it back only after creating and confirming the key.
While a backup operation is running, the + Storage server and Disconnect buttons are inactive.
If something went wrong
SSH server unavailable («Сервер SSH недоступен»)
The tracker did not get the fingerprint: the SSH server did not respond at the specified IP and port. Check the Server IP, the SSH port and that the storage server accepts SSH connections.
Could not connect: check the password/key and the server fingerprint («Не удалось подключиться: проверьте пароль/ключ и отпечаток сервера»)
The tracker did not log in to the server. Possible causes:
- wrong login, password or key;
- the key is protected with a password, and the Key passphrase, if set field is empty or filled in incorrectly;
- the server fingerprint did not match the confirmed one;
- the server did not respond or SFTP is disabled on it.
Fix the login details. If the fingerprint may have changed, click Check SSH server and compare it again.
No access to the backup folder or the path contains a link («Нет доступа к папке резервных копий или путь содержит ссылку»)
The tracker could not open or create the tracker-backups folder. Check that the user can create folders at the specified path and that the path has no symbolic links and no files in place of folders.
The message “No write permission for the folder” («Нет права записи в папку») means the folder opened, but the test file could not be written or deleted. Check the user's write permissions for tracker-backups.
Create a backup encryption key first (Settings → Backups). Refresh the page. («Сначала создайте ключ шифрования копий (Настройки → Резервные копии). Обновите страницу.»)
The server window was opened before the key state changed: the key was not created, not confirmed or is damaged. Refresh the page and look at the Backup encryption («Шифрование копий») block: create the key or replace it, then connect the server again.
Wait for the operation to finish. If a manual restore is required, contact the server administrator. («Дождитесь окончания операции. Если требуется ручное восстановление, обратитесь к администратору сервера.»)
The tracker is running another operation: creating a backup, verifying, restoring or checking disk space. Wait for it to finish and try again. If the top of the tab shows “Automatic rollback not completed. Server administrator help is needed; new operations are blocked.” («Автоматический возврат не завершён. Нужна помощь администратора сервера; новые операции заблокированы.»), see Backup verification and in-place restore.
Backup service unavailable («Служба резервных копий недоступна»)
The backup service on the tracker server did not respond to the panel's request. Check the service state and log with the commands from the Installation files, ports, services and logs page.