█████████████████████████████████████████████████████████████████ █▒███ █ ▒ █ ▒ █ █ █▒█ █▒█                
██████▒███████▒███ █ █▒███▒███▒███████████████████████▒███████ █ ▒ ▒ █ ▒             █ ▒ █                 
███████████████████ █ ███████████████████████████████████████▒█▒█ █ █ █ █ █ █ █ █ █ █ █ █ █ ▒ █ █ █ █ █ █ █
▒███▒███▒███▒███▒█ ▒ ▒▒█▒███▒███▒███▒███▒███▒███████▒███▒███▒█ █     ▒    ██ ███ █▒█ █▒█ █▒                
███████████████████ █ ███████████████████████████████████████ █     █ █   █████████████████                
██▒███████▒███▒█▒█     ███▒███▒███▒███████ █▒█ █▒█▒███▒███▒█▒▒            ▒███▒█▒█ █▒█▒███                 
█████████████████ █ ▒ ███████████████████▒█▒█ █▒█ ███████████ ▒   ▒ ▒ █ ▒ █████████████████   ▒   ▒       ▒
▒███▒███▒███▒█ █ █ █ █ █▒███▒███▒█ █ █▒█ █ ▒ ▒ █ ▒ █ █ █ █▒█               █▒███ █▒█ █▒█ █ █ █ █ █▒█ █ █ █ 
███████████████████████ ███████████ ███ █▒█ █ █ █ █ █▒█ █████             ███████████████▒▒ █▒█▒█████▒█████
 █ █▒█ ███ █ █ █▒█ █ █ ▒▒█▒███████ ▒▒█▒▒ █           ▒   █ █               █▒█▒███▒███▒██▒   █ ▒ █ █ █ █▒█ 
█▒█▒█▒███▒█▒█ █▒█▒███▒  █▒███████ █ ███ █ ▒           █ ▒ █                ██████████▒███   ▒     █ ▒ █████
 ▒ █ █ █ ▒ ▒   ▒ ▒ █ █   ▒ █ █▒█ ▒   █                     ▒               █ █ █ █▒█ █ █               █ █ 
█ █ █ █▒█ █ █   █ █ █▒  █ █ ███▒█   ███                   ▒                ▒█▒█▒█▒█ █ █ █             ▒▒█▒█
       ▒             ▒       █ ▒     █                                     █▒█ ▒ █ ▒ ▒                 ▒ ▒ 
      █             ▒       █ █       ▒                                     █ ▒ ▒ █                     █  
                                                                                                           
                                                                            █

Backups and restores

Last updated 2026-09-29

A Weald backup is a Postgres dump plus the media bucket, and both halves are ciphertext. A backup can go anywhere, including a provider you would not otherwise trust, and it is worthless without a member device's keys. Take one before you invite the second person.

What to back up

The relay's Postgres database, which holds envelopes, access sets, invites and the transparency log.
The object storage bucket, which holds encrypted media blobs the relay has no key for.

wealdrelay backup wraps both into one tarball. pg_dump and a bucket sync do the same by hand.

What a backup cannot contain

A backup holds no key that opens any of it. Workspace keys are generated on member devices and never reach the relay. A stolen backup is ciphertext plus a set of envelope sizes and timestamps.

Tell whoever reviews your backup policy that the metadata carries the sensitivity. An adversary with the backup gets sizes, timing and connection patterns.

Restoring

wealdrelay restore --from <tarball> puts a relay back. The flag is required, and a bare positional path is refused. Clients reconcile on their next connection and repair gaps from their own local copies, so a restore from a slightly stale backup heals itself.

That follows from every client holding a full copy. It also means a restore does not roll the workspace back, because members push back everything the backup was missing.

What a restore does not undo

A restore does not resurrect a revoked device. Revocation is an epoch change in the workspace, carried by member devices. A removed device stays removed even if the relay is rolled back to before the removal.

The reverse also holds. A member added after the backup was taken is still a member, because the group state that admitted them lives on their device and everybody else's.

Testing it

Restore into a scratch relay and connect one client to it. Do this once.

Check for two failure modes. A dump taken without the bucket restores a relay whose media references resolve to nothing. A bucket copied without the dump restores nothing at all.

Leaving

Migration off the hosted tier, or off your own relay onto another, takes three steps: back up, restore elsewhere, repoint the client. There is no export format and nothing to request. A relay holds nothing that member devices do not already have.

Backups and restores

What to back up#

What a backup cannot contain#

Restoring#

What a restore does not undo#

Testing it#

Leaving#