CzechIdM database backups

Backup configuration

Backup jobs and scripts are already prepared, you only need to activate them. This is done using systemd units.

  • iam-czechidm-db-backup.service - Service which creates backups, a part of the service is backup retention.

  • iam-czechidm-db-backup.timer - Planned task configuration; defines the interval in which iam-czechidm-db-backup.service is run.

Backup status

Backups are created in the /data/volumes/czechidm-db/backup/ directory in a form of a gzipped SQL script. You can, optionally, encrypt the backup. Status of the scheduled task can be found using these commands:

[root@localhost ~]# systemctl status iam-czechidm-db-backup.service
[root@localhost ~]# systemctl status iam-czechidm-db-backup.timer
[root@localhost ~]# systemctl list-timers --all

Activating planned backup tasks

To activate scheduled backup tasks, run a timer and activate its automatic start after the operating system starts. Deactivate scheduled backup tasks in the same way, using stop or disable instead.

[root@localhost ~]# systemctl start iam-czechidm-db-backup.timer
[root@localhost ~]# systemctl enable iam-czechidm-db-backup.timer

Backups can be created ad-hoc by running the service iam-czechidm-db-backup.service manually. The service will process backup retention, and then it will create a new backup.

Recover from backup

Recovery from a database dump can only be done if CzechIdM (the service iam-czechidm) is not running. The entire recovery can take up to several tens of minutes depending on the size of the database.

  1. Stop the CzechIdM service.

    [root@localhost ~]# systemctl stop iam-czechidm

  2. Switch to the container with the database and access the database. Drop the entire database "czechdim". Disconnect from the database by using the command \q.

    [root@localhost ~]# docker exec -it czechidm-db bash

root@czechidm-db:/# psql -U postgres
psql (12.5 (Debian 12.5-1.pgdg100+1))
Type "help" for help.

postgres=# drop database czechidm ;
DROP DATABASE

postgres=# \q

  3. Start the recovery from the backup.

    root@czechidm-db:/# gunzip -c FILEWITHBACKUP.sql.gz | psql -U postgres

  4. Start the CzechIdM service

    [root@localhost ~]# systemctl start iam-czechidm

Backup encryption

This functionality is available since iam-app-czechidm-db version 0.4-0 and only with the container image bcv-postgres:12-r2. The image version can be found in the service configuration (file /data/registry/node-active-config/docker-compose-czechidm-db.yml).

During the update installation, a new encryption key for backups is generated. This key is unique and can be used immediately. However, if you want to change it, you can do so by running the following command.

[root@localhost ~]# openssl rand -base64 32 > /data/volumes/czechidm-db/secrets/db-backup-symkey.pwfile

Backup encryption needs to be activated at the container level.

  1. Edit the file /data/registry/node-active-config/docker-compose-czechidm-db.yml.

    • Set the variable DB_ENCRYPT_BACKUP to true.

  2. Stop the CzechIdM service using systemctl stop iam-czechidm.

  3. Restart the database service using systemctl restart iam-czechidm-db.

  4. Start the CzechIdM service using systemctl start iam-czechidm.

  5. The next performed backup will be encrypted.

You can tell that a backup is encrypted by its file suffix. Unencrypted backups have the suffix .sql.gz, encrypted ones have suffix sql.gz.e. In order to recover data from an encrypted backup, you have to first decipher it after which you will have a regular unencrypted backup. This backup can be recovered using the process for recovering from unencrypted backups.

Encryption is done internally by the openssl program with parameters -aes-256-cbc, -salt, -pbkdf2. Any version of OpenSSL supporting these parameters can be used to decipher the backup.

Run encrypting
openssl enc -e -aes-256-cbc -salt -pbkdf2 -pass file:/run/secrets/db-backup-symkey.pwfile -in mydatabase.sql.gz -out mydatabase.sql.gz.e
Run deciphering
openssl enc -d -aes-256-cbc -pbkdf2 -pass file:/run/secrets/db-backup-symkey.pwfile -in mydatabase.sql.gz.e -out mydatabase.sql.gz