Backups and restore

A backup run writes two artifacts and only records success after it has read each one back and compared its size. One artifact can be restored; the other explains what the database contained.

Artifact	Contents	Restorable
mimir-YYYYMMDD-HHMMSS.dump.enc	pg_dump -Fc of the whole database	Yes, with pg_restore
settings-YYYYMMDD-HHMMSS.json.enc	Settings, projects, provider labels	Read by hand

What is deliberately absent

Provider API keys, backup credentials and the Resend key: the settings export drops them whole.
Memory bodies in the settings export. They live in the dump, which is the artifact that restores them.
Any plaintext. Both artifacts are AES-256-GCM, keyed from MIMIR_SECRET.

Targets

Choose S3 or WebDAV in Admin → Backups. S3 takes a bucket, an endpoint, a region, an optional prefix and path-style addressing for MinIO. WebDAV takes a base URL, a username and a password — pCloud works through https://webdav.pcloud.com with an app-specific password.

Retention

Retention counts restore points, not files. A value of 14 keeps the fourteen most recent runs, both artifacts of each, and deletes older ones together. Nothing outside the configured prefix is touched.

Restore

bash

# decrypt an artifact
./scripts/decrypt-backup.mjs mimir-20261025-030000.dump.enc mimir.dump

# restore into a running database
DATABASE_ADMIN_URL=postgres://mimir_owner:...@db:5432/mimir ./scripts/restore.sh mimir.dump --yes