<commit_before>---
owner_slack: "#2ndline"
title: Offsite backups
section: Backups
layout: manual_layout
parent: "/manual.html"
old_path_in_opsmanual: "../opsmanual/2nd-line/offsite-backup-and-restore.md"
last_reviewed_on: 2017-01-28
review_in: 6 months
---



> **This page was imported from [the opsmanual on github.gds](https://github.gds/gds/opsmanual)**.
It hasn't been reviewed for accuracy yet.
[View history in old opsmanual](https://github.gds/gds/opsmanual/tree/master/2nd-line/offsite-backup-and-restore.md)


# Offsite backups

We use [duplicity](http://duplicity.nongnu.org/) to perform offsite backups. Some
backups are encrypted with GPG before being shipped to an Amazon S3 bucket.

The fingerprint of the key can be found in `hieradata/production.yaml` within
the [govuk-puppet](https://github.com/alphagov/govuk-puppet) repository as
`_: &offsite_gpg_key `.
The key and passphrase are both stored in encrypted hieradata in the
[deployment repository](https://github.gds/gds/deployment),
as `backup::assets::backup_private_gpg_key` and `backup::assets::backup_private_gpg_key_passphrase`
respectively (the same private key is used for all offsite backups).

## Rotating offsite backups GPG keys

Please see
<https://github.gds/pages/gds/opsmanual/infrastructure/howto/rotate-offsite-backup-gpg-keys>

## Restoring offsite backups of a datastore

This requires access to 'production credentials hieradata' to retrieve the
AWS credentials and GPG key to decrypt the backups.

Connect to the machine where you want to restore the backup. For this example,
we will try to restore and unpack a MySQL database on a vagrant vm.

On a fresh VM, you may require the following packages for this exercise,<commit_msg>Fix link for rotating offsite backups GPG keys<commit_after>---
owner_slack: "#2ndline"
title: Offsite backups
section: Backups
layout: manual_layout
parent: "/manual.html"
old_path_in_opsmanual: "../opsmanual/2nd-line/offsite-backup-and-restore.md"
last_reviewed_on: 2017-01-28
review_in: 6 months
---



> **This page was imported from [the opsmanual on github.gds](https://github.gds/gds/opsmanual)**.
It hasn't been reviewed for accuracy yet.
[View history in old opsmanual](https://github.gds/gds/opsmanual/tree/master/2nd-line/offsite-backup-and-restore.md)


# Offsite backups

We use [duplicity](http://duplicity.nongnu.org/) to perform offsite backups. Some
backups are encrypted with GPG before being shipped to an Amazon S3 bucket.

The fingerprint of the key can be found in `hieradata/production.yaml` within
the [govuk-puppet](https://github.com/alphagov/govuk-puppet) repository as
`_: &offsite_gpg_key `.
The key and passphrase are both stored in encrypted hieradata in the
[deployment repository](https://github.gds/gds/deployment),
as `backup::assets::backup_private_gpg_key` and `backup::assets::backup_private_gpg_key_passphrase`
respectively (the same private key is used for all offsite backups).

## Rotating offsite backups GPG keys

Please see
<https://docs.publishing.service.gov.uk/manual/rotate-offsite-backup-gpg-keys.html>

## Restoring offsite backups of a datastore

This requires access to 'production credentials hieradata' to retrieve the
AWS credentials and GPG key to decrypt the backups.

Connect to the machine where you want to restore the backup. For this example,
we will try to restore and unpack a MySQL database on a vagrant vm.

On a fresh VM, you may require the following packages for this exercise,
{'fraction_non_alphanumeric': 0.09452449567723344, 'fraction_numerical': 0.007492795389048991, 'mean_word_length': 5.068181818181818, 'pattern_counts': {'":': 0, '<': 5, '<?xml version=': 0, '>': 7, 'https://': 10, 'lorem ipsum': 0, 'www.': 0, 'xml': 0}, 'pii_count': 0, 'substrings_counts': 0, 'word_list_counts': {'cursed_substrings.json': 0, 'profanity_word_list.json': 0, 'sexual_word_list.json': 0, 'zh_pornsignals.json': 0}}
{'dir': 'git-commits-cleaned', 'id': '4901172', 'n_tokens_mistral': 1120, 'n_tokens_neox': 1062, 'n_words': 370}