SafeGrd is a new backup service for PostgreSQL 13 and later that restores every backup on a schedule and checks the row counts.
It takes a backup, restores it later into memory or a throwaway database, and counts what came back, so you find out a backup is broken before you need it. ## Taking the backup The `safegrd` daemon runs on a host next to your database and connects as a read-only role. On PostgreSQL 14 and later that role only needs `pg_read_all_data`. On 13 you grant each schema instead. The schema comes from `pg_dump` and the rows come over binary `COPY`, in one transaction. After the first run, each backup uploads only what changed. The backup is encrypted with [age](https://age-encryption.org) on your host before it leaves, then written to an S3 bucket with Object Lock on. That can be your own bucket or SafeGrd-hosted storage. The backup data never goes through SafeGrd's servers. You choose how the age key is managed. With a customer-managed key, only you can decrypt these backups. With a SafeGrd-managed key, SafeGrd keeps your key sealed and releases it only to your enrolled hosts, so you can restore even after losing a host. Supabase, Neon and Amazon RDS work from a connection string. Supabase backups are restored on Supabase's own Postgres image, so the extensions in the dump load. ## Testing the backup We call the restore test a Fire Drill. It takes the newest backup, decrypts it and checks it in one of two ways: - In memory. The dump is replayed without a running server, and the table, row and column counts and the extensions are compared with what the backup recorded. - In a sandbox. The backup is restored into a throwaway PostgreSQL database and the counts are checked there. You can add your own SQL checks too, for example `SELECT count(*) FROM users WHERE email IS NULL` has to return `0`. Each drill writes a signed, dated record with the counts and the check results. Every record points at the one before it. The [attestation verifier](https://safegrd.dev/tools/attestation-verifier) checks the whole chain against SafeGrd's published signing key in your browser, with nothing to install. ## Trying it curl -fsSL https://safegrd.dev/install.sh | sh safegrd login safegrd enroll The [CLI source](https://github.com/safegrd/cli) is on GitHub under the Business Source License 1.1. The free plan covers one database. It is backed up daily to SafeGrd-hosted storage, or hourly to your own bucket, and drilled in memory once a week. Paid plans start at $15 a month and add hourly backups, sandbox drills and more databases. Docs: [safegrd.dev/docs](https://safegrd.dev/docs)
