Backups

A backup you have never restored is a hope, not a backup. This page is short enough to work through once with a test group.

What gets saved

Backups apply to persistent groups. Ephemeral servers are rebuilt from their layers on every start, so there is nothing in them worth keeping.

persistent = true
 
[backup]
at = ["04:00"]
keep = 7

At every listed time the cloud walks the group's directories under static/, tells each running server to flush its world to disk, writes a tar.gz per server into backups/ and lets the server continue. The flush matters: Paper keeps the main world in memory and only writes level.dat when told to save, so an archive taken without it would be incomplete.

The archive holds the server directory without cache, logs, libraries, versions, crash-reports and debug, which are all restored on the next start anyway. Its name carries the server and the time, for example Lobby-1-20260923-040000.tar.gz.

keep decides how many archives per server survive; the oldest beyond that are deleted after every run. At least one is always kept, whatever you configure.

By hand

groups <name> backup            write one now
groups <name> backup list       what is there
groups <name> backup restore    put one back

Restoring stops the server, unpacks the archive over its directory and starts it again. Only plain file names from backups/ are accepted, so a crafted name cannot write outside that directory.

What this does not do

The archives sit on the same disk as the servers. That protects you against a broken world, a bad plugin update and a wrong command, and not at all against a lost machine. Copy backups/ off the host on a schedule, for example with rsync or restic from a second machine pulling over SSH.

Practice the restore once while nothing is on fire. Create a test group, write a backup, delete something inside the world, restore, look at the result. Ten minutes now beat an hour of guessing under pressure.