Skip to content

Backup & Recovery

Database

Each environment's platform state (devices, configs, organizations, enrollment codes, ACL, roles, releases, relays) lives in its own database on the shared Scaleway RDB instance digilan-shared. The radius-ctrl and Monsieur Wifi databases sit on the same instance.

The shared RDB has automatic backups disabled

environments/shared/database.tf sets disable_backup = true on digilan-shared. Nothing restores these databases unless you take a dump. Zitadel's own instance (zitadel) has backups enabled.

Manual backup of one environment:

DSN=$(tofu -chdir=infra/terraform/environments/<env> output -raw database_connection_string)
pg_dump "$DSN" --format=custom --file=digilan-<env>-$(date +%F).dump

The output is sensitive; keep it out of shell history and logs.

OpenTofu state

State is in GitLab's HTTP backend, one state per environment, with version history. List the versions:

glab api "projects/digilan%2Finfra%2Fterraform/terraform/state/<env>/versions"

Restore a specific version through the GitLab UI. Never edit state by hand.

Device-side state

The agent keeps its data in /var/lib/edge-agent:

  • identity.json: gateway id, API token, nexus and realtime URLs. Lose it and the gateway has to re-enroll.
  • config.json: the last applied config, so the gateway keeps serving traffic after a reboot without reaching nexus.

Config history

Every save from the portal inserts a new gateway_configs row. Rollback creates a new version from an old payload; nothing is overwritten.

Table Retention
gateway_configs forever
gateway_states latest only, one row per device
gateway_logs 48 hours for pf logs, 7 days otherwise
gateway_metrics 24 hours

Pruning runs hourly inside nexus, so only while an instance is up.

Rebuilding an environment

  1. tofu apply in environments/<env> to recreate the database, containers, bucket, Pages project and DNS.
  2. Restore the latest dump into the new database.
  3. Redeploy nexus and authz (their deploy jobs on the latest tag).
  4. Set the realtime INTERNAL_API_KEY from the new internal_api_key output (Terraform → Secrets) and redeploy realtime and the portal.
  5. Gateways reconnect on their own: their api_token is in the restored database.