Establish a protected destination first
Fresh installation has no configured backup destination. The root-controlled reviewed planning/enrollment process must supply repository, credentials, policy and an independently retained recovery key. The UI lists authorized destinations; it cannot create arbitrary browser-controlled remote credentials or raise the protected bandwidth limit. A same-server repository is not off-server disaster recovery.
Create a policy
Choose recovery format/scope, account where applicable, components, destination, policy name, five-field schedule, IANA timezone, notification preference and whether to run once after save. Review exact components and limits. Policies use /v1/backup-policies; on-demand runs use /{id}/run.
Retention fields include keep-last 1–1000, daily 0–366, weekly 0–260, monthly 0–120 and within-days 1–3650 of the latest matching snapshot. Rules keep their union; the day window is relative to the latest snapshot, not the current clock. Maximum snapshot bytes is bounded from 1 MiB to 16 TiB by the interface and protected destination policy still applies.
Inspect and verify snapshots
The snapshot list/detail shows state, scope, expiry and integrity evidence. Verification is a separate /v1/backup-snapshots/{id}/verify operation. The restic implementation records completion only after exact snapshot-content checks. Retain the encryption/recovery key outside the server and test access independently; losing the only key loses encrypted recovery.
Selective restore
The current restore UI is Admin-only. Select an eligible complete, unexpired, integrity-verified snapshot and load its detailed inventory. Choose supported items and an authorized target account, then request /restore-preview with explicit selections. The preview must contain plan ID, revision, manifest digest and conflict digest. Review every overwrite and exact confirmation before /restore with the same reviewed plan.
Whole-panel recovery follows its protected installation mapping and manual reconstruction sequence; the browser is not a full-machine restore switch. Customer menu leaves for file/database restore and backup download are explicitly unavailable in this checkpoint.
Recovery limits and proof
Snapshots do not reconstruct every database identity/grant/password, mailbox definition/hash, application secret or transfer state. A full-server backup menu is unavailable, and a local component restore is not complete disaster recovery. Rehearse reconstruction on an independently designated VM, including accounts, files, databases, mail, DNS/TLS and reboot. Account termination and production updates can remain blocked until required full reconstruction evidence exists. Do not delete a hosting account merely because a snapshot is readable.