Skip to main content

Backups and restore

Tagaris backs itself up from Application settings. A backup is one archive holding the whole database and, optionally, uploaded photos and attachments, so a single file is enough to rebuild the install. The install owner manages backups under Settings, then Application, then Backups.

Taking backups​

Run now takes a backup immediately. A schedule runs one automatically every day or every week, overnight, and a retention count caps how many are kept locally: the oldest are removed as new ones arrive. Archives are written to the uploads volume.

"Include photos and attachments" adds the photos volume (photos, thumbnails and attachments) to the archive. Leave it on unless the archive size is a problem. Without it, a restore recovers the register but not the files.

Encryption​

Set a passphrase and every new backup is encrypted (AES-256-GCM). The passphrase is never stored in the archive itself; the server keeps an encrypted copy, so a restore on the same server can use it. Restoring on another server means entering the passphrase again, so keep a copy in a password manager. Without it, a backup cannot be opened elsewhere.

Offsite copies​

Backups can also upload to S3-compatible storage (AWS S3, Backblaze B2, Wasabi, MinIO and similar). Fill in the endpoint, bucket and keys and each finished backup is uploaded after it is written locally. An offsite copy is what saves you when the server's own disk is lost.

Or copy the volume​

Tagaris is a container, and every backup archive is a file under backups/ on the uploads volume. If you already back up your Docker host (a nightly job that copies volumes to another machine, a snapshot of the VM, a tool such as restic or Borg), point it at that folder and you have an offsite copy with nothing to configure in Tagaris. Encrypted archives stay encrypted. The S3 option above is for hosts with no backup of their own; SFTP and other targets are deliberately not built, because the volume copy covers them.

Restoring​

Choose a backup and restore it. Restore replaces the current database with the archive's contents behind a typed confirmation, so it cannot be clicked through by accident. If the backup is encrypted you enter the passphrase at this point.

Moving to a new server​

  1. Download a backup from the old server (or fetch the offsite copy).
  2. Install Tagaris on the new server and sign in as the owner.
  3. Upload the backup under Backups, then restore it.

Values set through the environment travel with your compose file, not the backup: set BETTER_AUTH_SECRET and any SSO_* values on the new server before restoring. The restore screen lists what to carry over. If the install uses single sign-on and it is not yet reconfigured on the new server, the restore shows a one-time password for the owner so you are not locked out.

A restored install keeps its install ID, so an applied licence carries over and keeps working. If the backup came from an older Tagaris version, restart the app after the restore so migrations run.

Manual backups from the host​

The in-app backups are the simplest route, but a copy taken from outside the app is a good belt-and-braces second line. Both commands assume the Compose install from Installing Tagaris.

Database, using pg_dump into a file:

docker compose exec -T postgres pg_dump -U tagaris tagaris > tagaris-db.sql

Photos volume, into a tarball. The volume name is the Compose project name plus _photos (run docker volume ls to confirm; the project name is the folder name):

docker run --rm -v tagaris_photos:/data -v "$PWD":/backup alpine \
  tar czf /backup/tagaris-photos.tar.gz -C /data .

To restore into a fresh instance, start the stack once so the database exists, then:

# Database (this replaces current data):
docker compose exec -T postgres psql -U tagaris -d tagaris < tagaris-db.sql

# Photos:
docker run --rm -v tagaris_photos:/data -v "$PWD":/backup alpine \
  sh -c "cd /data && tar xzf /backup/tagaris-photos.tar.gz"

Exports​

You can also export data from the app at any time, and it is always free. An administrator can download a full JSON export of the organisation (assets and their history, stock, people, locations, categories, templates, custom fields, status labels, issues, vendors, contracts and purchase orders) from Settings, Organisation, Data. Assets on their own export as CSV or JSON from the assets list, and reports as CSV from the reports pages; those need the "Run reports and export data" permission. Exports are a good second copy of the core data, but they do not replace a backup for a full restore: secrets and photo files are not included.

What backups do not cover​

The backup covers Tagaris: the register database and uploaded files. It does not back up your reverse proxy, TLS certificates or the compose file itself; keep those with your server configuration.