> ## Documentation Index
> Fetch the complete documentation index at: https://link.datarelay.run/llms.txt
> Use this file to discover all available pages before exploring further.

# Use case: Backup and restore

> Protect Server identities, policies and service reservations, then verify recovery.

# Back up and recover the DRLink Server safely

**Outcome:** An operator creates a Server backup, validates it, restores when necessary and verifies inventory, identity continuity, access policy and real application reachability.

> [!WARNING]
>
> A restore replaces security-sensitive persistent state and can interrupt clients. Perform the restore step **only** during an explicitly approved recovery window on the intended Server, after reviewing the archive and target version. Do not use this procedure to test casually on a production instance.

## Step 1 — inspect the healthy state

![Real Data Relay Link CLI capture — Captured product build identity: check product version and DRLink Server role.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/server-version.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=d8f38d05298dbc579aa0e9b5d4515f32)

*Figure 1. Captured product build identity: check product version and DRLink Server role. CLI output example; sensitive addresses and hostnames are masked.*

**Server shell:**

```bash theme={null}
sudo drlink system version
sudo drlink show status
sudo drlink system diagnostics
sudo drlink show managed-hosts
sudo drlink show remote-access
sudo drlink show internet-access
sudo drlink show ai-access
```

Record the installed version, active Managed Hosts, Remote Service endpoints and policy modes. A backup from an unrelated release is not automatically compatible.

## Step 2 — create and securely retain the backup

![Real Data Relay Link CLI capture — Server System menu: 3 Backup & Restore, 5 Diagnostics, 8 Version Information.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/server-system-menu.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=1671593497d20f954b4279441e133a91)

*Figure 2. Server System menu: 3 Backup & Restore, 5 Diagnostics, 8 Version Information. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
system backup
```

Record the **exact archive path printed by the product**. Use the built-in workflow: **/var/lib/drlink/drlink.db** and the PKI, secrets, policies, registry and reservations must form a consistent snapshot. Copy the archive to secure off-host storage using your approved encrypted transfer/backup mechanism, never to a public docs repository. Do not copy only the live SQLite file (WAL consistency risk).

## Step 3 — validate the archive before recovery

**Server shell**, using the output path from Step 2:

```bash theme={null}
sudo drlink system backup validate <exact-backup-archive-path>
```

Expected: successful integrity/format/version validation. This is read-only and must complete **before** a restore. A corrupt or incompatible archive is not a recovery candidate.

## Step 4 — restore only when authorized

Under the approved recovery plan:

```bash theme={null}
sudo drlink system restore <validated-backup-archive-path>
```

Review the product's confirmation and access-impact information; **do not automatically answer Yes**. The product should snapshot and validate its state transition and report any incomplete rollback honestly. Record all failure evidence before attempting another recovery.

## Step 5 — verify identity and real traffic after restoration

![Real Data Relay Link CLI capture — Real Agent diagnostics excerpt: inspect runtime/Server connectivity after recovery.](https://mintcdn.com/data-relay/RzAl7zFhuZCRSIKj/images/cli-captures/agent-diagnostics.png?fit=max\&auto=format\&n=RzAl7zFhuZCRSIKj\&q=85\&s=0c1d10cec03dbbd66d89afde396e95a4)

*Figure 3. Real Agent diagnostics excerpt: inspect runtime/Server connectivity after recovery. CLI output example; sensitive addresses and hostnames are masked.*

**Server REPL:**

```text theme={null}
show status
show managed-hosts
show remote-access
show internet-access
show ai-access
system diagnostics
system revisions
```

On **each affected Agent Host**:

```text theme={null}
show agent
show remote-services
system diagnostics
system synchronize
```

Check that immutable Managed Host identities, Remote Service IDs and public endpoint reservations were preserved wherever compatible, and that Agents reconnected/reconciled the active generation. Then run an **actual approved SSH or Internet Access application request** plus one intentionally denied policy request as in the corresponding playbooks.

## Failure response

* **Backup validation FAIL:** do not restore. Keep evidence and obtain a healthy compatible archive.
* **Agent missing after restore:** check original identity/trust, management connectivity and Agent sync; do not immediately re-enroll and lose the identity history.
* **Policy changed unexpectedly:** compare current revision and backup baseline before authorizing another mutation. Never reset Remote Access policy merely to restore connectivity, because initial Remote Access is ALLOW.
* **Service appears HEALTHY without real traffic:** verify the application's endpoint separately. Runtime/heartbeat status alone does not prove the destination is reachable.

See [backup/restore reference](https://link.datarelay.run/operations/backup-restore.md) and [troubleshooting](https://link.datarelay.run/troubleshooting/overview.md) for further recovery boundaries.

## Current behavior check — 2026-10-28

After restore, backup-time host presence and proxy health require fresh Agent verification. Connected Agents reconcile when the Server lacks current Remote Service verification; run diagnostics/synchronize and test real traffic. Keep both the archive and error evidence if restore or rollback fails.

[Current CLI inventory](https://link.datarelay.run/drlink/cli-reference.md) · [MCP compatibility](https://link.datarelay.run/reference/mcp-validation.md)


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.