Backups

A backup you have never restored is a hope, not a backup. This page is short enough to work through once with a test group.

What gets savedCopy Anchor Link

Backups apply to persistent groups. Ephemeral servers are rebuilt from their layers on every start, so there is nothing in them worth keeping.

persistent = true

[backup]
at = ["04:00"]
keep = 7

At every listed time the cloud walks the group's directories under static/, tells each running server to flush its world to disk, writes a tar.gz per server into backups/ and lets the server continue. The flush matters: Paper keeps the main world in memory and only writes level.dat when told to save, so an archive taken without it would be incomplete.

The archive holds the server directory without cache, logs, libraries, versions, crash-reports and debug, which are all restored on the next start anyway. Its name carries the server and the time, for example Lobby-1-20260923-040000.tar.gz.

keep decides how many archives per server survive; the oldest beyond that are deleted after every run. At least one is always kept, whatever you configure.

By handCopy Anchor Link

groups <name> backup            write one now
groups <name> backup list       what is there
groups <name> backup restore <file>   put one back

A restore only goes onto a server that is not running. Because the cloud immediately restarts a missing persistent server, pause the group first:

groups Lobby disable
service Lobby-1 stop
groups Lobby backup restore Lobby-1-20260925-040000.tar.gz
groups Lobby start

The archive is unpacked over the server's directory. Existing files are overwritten, files that are not in the archive stay. Only file names from backup list are accepted, so a crafted name with ../ cannot write outside that directory.

What this does not doCopy Anchor Link

The archives sit on the same disk as the servers. That protects you against a broken world, a bad plugin update and a wrong command, and not at all against a lost machine. Copy backups/ off the host on a schedule, for example with rsync or restic from a second machine pulling over SSH.

Practice the restore once while nothing is on fire. Create a test group, write a backup, delete something inside the world, restore, look at the result. Ten minutes now beat an hour of guessing under pressure.