# Backup and restore

Three things must be backed up together. A backup missing any one of them is
not a usable backup.

1. **The database** — everything transactional.
2. **`storage/documents/`** — encrypted customer documents.
3. **`config.php`** — holds the key that decrypts those documents.

**Documents and the key are useless without each other.** If you back up the
documents but lose `config.php`, the files are permanently unreadable. Nobody
can recover them, including us. Keep an offline copy of `config.php`.

## Weekly manual backup

```bash
cd /home/USER
DATE=$(date +%Y%m%d)
mysqldump -u DBUSER -p DBNAME --single-transaction --quick > ~/backup-db-$DATE.sql
tar czf ~/backup-docs-$DATE.tar.gz storage/documents
cp config.php ~/backup-config-$DATE.php
```

Download all three and delete them from the server. Keep at least four weekly
sets and one monthly set off-site.

## Restore

```bash
mysql -u DBUSER -p DBNAME < backup-db-YYYYMMDD.sql
tar xzf backup-docs-YYYYMMDD.tar.gz -C /home/USER/
cp backup-config-YYYYMMDD.php /home/USER/config.php
chmod 640 /home/USER/config.php
```

Then verify: sign in as admin, open a paid order, and download one document. If
it opens, the key and the files match. If it does not, stop and check you have
restored the matching `config.php` — do not re-run the installer, which would
generate a new key and orphan every existing document.

## What to test quarterly

Restore into a staging database and confirm a document decrypts. A backup you
have never restored is a hypothesis, not a backup.