Managed Postgres backups, off-site and encrypted
How Aloof backs up managed Postgres and volumes: local dumps, client-side AES-256-GCM, a separate location, GFS retention and a weekly test restore.
A backup on the same disk as the data protects you from mistakes, not from losing the disk. Aloof keeps both kinds of backup.
Layer 1: local, fast to restore
Each managed database gets a daily pg_dump in custom format (7 kept), and you can take one any time with aloof pg backup. Volumes get on-demand snapshots. These restore in seconds because they're on the same host.
Layer 2: off-site, encrypted before upload
Once a day, fresh dumps of every database, every volume snapshot, and the control plane's own database go to S3-compatible object storage. The storage is Hetzner Object Storage in Helsinki, a different location from our compute in Nuremberg.
- Client-side encryption: data is encrypted with AES-256-GCM in 1 MB chunks on our server before upload. Each chunk is authenticated, and the final chunk is marked, so truncation or tampering is detected on restore. The object store only ever sees ciphertext.
- Platform secrets (encryption keys, tokens) get a second layer: a separate passphrase-derived key (scrypt), so the backup key alone can't open them.
- Retention: 7 daily, 4 weekly and 3 monthly backups (grandfather-father-son), plus a bucket lifecycle rule as a backstop.
- Integrity: SHA-256 is checked on download before anything is restored.
Backups you've never restored aren't backups
A weekly job downloads the latest copies, decrypts them, and restores the control-plane database into a scratch Postgres. It then checks the table count, and checks that volume archives and the secrets bundle open. Results are recorded per backup. The admin dashboard raises an alert if the newest off-site backup is more than 26 hours old or a verification fails.
Restoring
$ aloof pg offsite mydb $ aloof pg offsite-restore mydb pg_20261013082102_065225
The same works for volumes (aloof snapshots offsite-restore), through the API and MCP, and from the dashboard.
Limits
These are logical backups. There's no point-in-time recovery or streaming replica yet, so the recovery point is your newest dump. Take an on-demand backup before risky migrations.