Backup and restore

What to back up

1. Postgres — state: users, orgs, dashboards, rules, audit log. pg_dump daily + WAL streaming for PITR.
2. ${CA_DIR}/secrets.key — the master key for AES-256-GCM SecretBox. Losing it = losing all sealed secrets (OAuth tokens, channel signing secrets).
3. ${CA_DIR}/ca.crt + ca.key — the CA for agents. Losing it = re-enrolling all agents.
4. TSDB data — storageDataPath. A snapshot via the TSDB API + a backup utility.

Restore

1. Postgres restore from a dump (or PITR)
2. Restore CA_DIR with secrets.key + ca.{crt,key}
3. TSDB restore from a snapshot
4. Start the API — it picks up the existing state

Test the restore at least once a quarter. A backup you've never restored is theoretical.