Backups & Restore
What to back up
- PostgreSQL database — products, orders, customers, plugin records, settings.
/opt/carphacom/installed/— extracted plugin/theme directories (manifests + compiled code)./opt/carphacom/marketplace-files/— uploaded media (logos, product images, icons)..env.localfiles — your secrets. Without these you cannot decrypt stored license keys or sessions.
The release directories under /opt/carphacom/releases/ are reproducible from the
distribution and do not need backup.
Automated daily backup
The one-click installer sets up a cron at 0 3 * * * (03:00 server time):
#!/bin/bash
# /opt/carphacom/shared/scripts/daily-backup.sh
set -e
DATE=$(date +%Y%m%d_%H%M%S)
DEST=/opt/carphacom/shared/backups
mkdir -p $DEST
# Database
PGPASSWORD=$DB_PASS pg_dump -h localhost -U medusa medusa_store \
| gzip > $DEST/db_$DATE.sql.gz
# Plugins + media
tar -C /opt/carphacom -czf $DEST/files_$DATE.tar.gz \
installed/ marketplace-files/
# Env files
tar -C /opt/carphacom/current -czf $DEST/env_$DATE.tar.gz \
medusa-backend/.env admin-panel/.env.local nextjs-storefront/.env.local
# Retention: keep 14 days local
find $DEST -type f -mtime +14 -delete
# Optional off-site (S3, B2, Hetzner Storage Box)
if [ -n "$BACKUP_S3_BUCKET" ]; then
aws s3 sync $DEST s3://$BACKUP_S3_BUCKET/ --delete
fi
Logs go to /opt/carphacom/shared/logs/backup.log. Check daily that the latest run
succeeded.
Off-site storage
Strongly recommended. Options:
- AWS S3 — set
BACKUP_S3_BUCKETand configure~/.aws/credentialsfor therootuser. - Backblaze B2 — same, with
aws --endpoint-url=https://s3.us-west-002.backblazeb2.com. - Hetzner Storage Box — rsync over SSH inside the cron script.
Keep at least 30 days of off-site retention.
Test restore (do this monthly)
On a separate VM:
# 1. Provision a fresh CarphaCom box (one-click or manual install)
# 2. Stop services
pm2 stop all
# 3. Restore database
gunzip -c db_20260420_030000.sql.gz | \
PGPASSWORD=$DB_PASS psql -h localhost -U medusa medusa_store
# 4. Restore files
tar -C /opt/carphacom -xzf files_20260420_030000.tar.gz
tar -C /opt/carphacom/current -xzf env_20260420_030000.tar.gz
# 5. Start
pm2 start all --update-env
Visit the test instance, log in as admin, verify orders and products show up. If anything is missing or broken, your backup process needs work — fix it before disaster strikes.
Point-in-time recovery (PITR)
For larger shops, enable PostgreSQL WAL archiving and use a tool like pgBackRest for
point-in-time recovery. This lets you restore to any second in the past 7 days, not just
nightly snapshots. Setup is documented at the pgBackRest project.