Backups & Restore

What to back up

PostgreSQL database — products, orders, customers, plugin records, settings.
/opt/carphacom/installed/ — extracted plugin/theme directories (manifests + compiled code).
/opt/carphacom/marketplace-files/ — uploaded media (logos, product images, icons).
.env.local files — your secrets. Without these you cannot decrypt stored license keys or sessions.

The release directories under /opt/carphacom/releases/ are reproducible from the distribution and do not need backup.

Automated daily backup

The one-click installer sets up a cron at 0 3 * * * (03:00 server time):

#!/bin/bash
# /opt/carphacom/shared/scripts/daily-backup.sh
set -e
DATE=$(date +%Y%m%d_%H%M%S)
DEST=/opt/carphacom/shared/backups
mkdir -p $DEST

# Database
PGPASSWORD=$DB_PASS pg_dump -h localhost -U medusa medusa_store \
  | gzip > $DEST/db_$DATE.sql.gz

# Plugins + media
tar -C /opt/carphacom -czf $DEST/files_$DATE.tar.gz \
  installed/ marketplace-files/

# Env files
tar -C /opt/carphacom/current -czf $DEST/env_$DATE.tar.gz \
  medusa-backend/.env admin-panel/.env.local nextjs-storefront/.env.local

# Retention: keep 14 days local
find $DEST -type f -mtime +14 -delete

# Optional off-site (S3, B2, Hetzner Storage Box)
if [ -n "$BACKUP_S3_BUCKET" ]; then
  aws s3 sync $DEST s3://$BACKUP_S3_BUCKET/ --delete
fi

Logs go to /opt/carphacom/shared/logs/backup.log. Check daily that the latest run succeeded.

Off-site storage

Strongly recommended. Options:

AWS S3 — set BACKUP_S3_BUCKET and configure ~/.aws/credentials for the root user.
Backblaze B2 — same, with aws --endpoint-url=https://s3.us-west-002.backblazeb2.com.
Hetzner Storage Box — rsync over SSH inside the cron script.

Keep at least 30 days of off-site retention.

Test restore (do this monthly)

On a separate VM:

# 1. Provision a fresh CarphaCom box (one-click or manual install)
# 2. Stop services
pm2 stop all

# 3. Restore database
gunzip -c db_20260420_030000.sql.gz | \
  PGPASSWORD=$DB_PASS psql -h localhost -U medusa medusa_store

# 4. Restore files
tar -C /opt/carphacom -xzf files_20260420_030000.tar.gz
tar -C /opt/carphacom/current -xzf env_20260420_030000.tar.gz

# 5. Start
pm2 start all --update-env

Visit the test instance, log in as admin, verify orders and products show up. If anything is missing or broken, your backup process needs work — fix it before disaster strikes.

Point-in-time recovery (PITR)

For larger shops, enable PostgreSQL WAL archiving and use a tool like pgBackRest for point-in-time recovery. This lets you restore to any second in the past 7 days, not just nightly snapshots. Setup is documented at the pgBackRest project.