Database restores
Configure backup format, encryption, database version, target, and gates for recurring restore validation.
Loading documentation…
Powered by heyo
A database restore schedule validates that one selected backup can be downloaded, decoded, imported into a temporary database, and checked against your gates.
RestoreTrust supports PostgreSQL, MySQL, MariaDB, and MongoDB. Each engine page lists the exact versions currently available.
Select the exact database version from the choices shown in the console. The version tables in this guide are a snapshot; the console and the database-engine catalog remain authoritative when the catalog changes.
Then describe the layers of the backup:
| Setting | Choices |
|---|---|
| Container | Detect automatically, none, tar, or ZIP |
| Compression | Detect automatically, none, gzip, zstd, xz, bzip2, or lz4 |
| Dump format | SQL for PostgreSQL, MySQL, and MariaDB; mongodump directory for MongoDB |
| Encryption | None, age identity, or age passphrase |
| ZIP password | Optional secret for password-protected ZIP containers |
MongoDB directory dumps must be packaged, so its container choices are automatic detection, tar, or ZIP.
Automatic detection examines content rather than relying only on the filename. Choose an explicit container or compression when you want to enforce the expected format; a mismatch fails the check.
RestoreTrust decodes from the outside inward: age encryption → compression → tar/ZIP container → database dump. Each layer is optional where the engine permits it. ZIP's own internal compression is part of its container; select None or Detect automatically for the separate compression layer when using ZIP.
| Backup layout | Supported use |
|---|---|
Plain SQL, optionally compressed, such as .sql or .sql.gz | PostgreSQL, MySQL, MariaDB |
A tar archive containing exactly one .sql file, optionally compressed as .tar.gz, .tar.zst, etc. | PostgreSQL, MySQL, MariaDB |
A ZIP archive containing exactly one .sql file, optionally password-protected | PostgreSQL, MySQL, MariaDB |
| A tar or ZIP archive of an uncompressed mongodump directory; tar may have an outer compression layer | MongoDB |
| Any supported layout encrypted with age after packaging/compression | Select the matching age mode and secret |
Do not compress individual dump files inside an archive. For example, use a tar containing backup.sql and then gzip the tar, rather than putting backup.sql.gz inside it. Archives must contain regular files and directories with safe relative paths; links, device entries, duplicate files, and paths escaping the archive are rejected.
Unsupported inputs include PostgreSQL custom, directory, and native tar dumps; mongodump --archive and mongodump --gzip output; nested compression; a ZIP wrapped in another compression layer; 7z/RAR archives; and OpenPGP/GPG encryption. A tar containing a plain PostgreSQL .sql file is supported, but a native pg_dump -Ft backup is a different format.
None does not silently accept age-encrypted input. Select the correct age mode and secret metadata, or the check will fail. For password-protected ZIP, select an archive-password secret with an automatic or ZIP container setting.
Choose the engine and exact source version. A nearby version is not evidence that the original backup is restorable under the conditions you require.
Use automatic detection for flexible input, or enforce the known container and compression. Add ZIP or age decryption metadata when required.
PostgreSQL, MySQL, and MariaDB accept an optional target database. MongoDB restores the dump's database layout and has no target-database field.
Require import completion, add targeted queries or MongoDB operations, and set duration limits where they reflect your recovery objective. At least one gate is required.
Start a manual check and inspect the selected artifact, restore stage, probes, and evidence before relying on recurring results.
Temporary restore data is used for the check and is not a replacement recovery environment. Do not put secrets or unnecessarily sensitive data in query output; probe results become part of the check record.