MySQL and MariaDB

backupd backs up MySQL 5.7 and later, and MariaDB 10.3 and later, with mysqldump in a single transaction. Your app keeps writing while the backup runs: InnoDB tables are read from one consistent snapshot and no tables are locked. backupd detects MariaDB from the server version.

Connection stringCopy Anchor Link

mysql://user:password@db.example.com:3306/app?ssl-mode=REQUIRED

• The scheme is mysql://.
• The port defaults to 3306.
• The database name is required, and each connection string backs up one database. Add each database you want backed up separately.
• Percent-encode special characters in the user or password.

TLSCopy Anchor Link

backupd always connects with TLS. Set the mode with ssl-mode (or sslmode).

PermissionsCopy Anchor Link

A read-only user is enough to back up. Because backups include routines, triggers and events, the user needs to be able to read those too. A typical grant:

CREATE USER 'backupd'@'%' IDENTIFIED BY 'choose-a-strong-password';
GRANT SELECT, SHOW VIEW, TRIGGER, EVENT ON app.* TO 'backupd'@'%';

On MySQL 8.0.20 and later, also grant SHOW_ROUTINE (a global privilege) so stored procedures and functions are included.

To restore from the app, the target needs a user that can create tables and insert data. In-app restores remove DEFINER clauses, so the target doesn't need SUPER or the original accounts.

What is backed upCopy Anchor Link

• One database: its tables, views, data, routines, triggers and events.
• Tablespaces are not dumped.
• GTID state is not written to the dump, so it restores into any server.

Files are named with the .sql.zst.age extension: plain SQL from mysqldump, compressed with zstd and encrypted with age.

Row counts and restore testsCopy Anchor Link

backupd counts every table's rows exactly from the dump as it is written. The restore test loads the backup into a temporary database on a sandbox MySQL server and compares each table. See Integrity checks and restore tests.

RestoringCopy Anchor Link

Before an in-app restore starts, backupd checks whether the target already has any of the backup's tables. If it does, the restore stops with a message naming them, unless you tick Replace tables that already exist in the target.

To restore yourself, see Restore without backupd.

LimitationsCopy Anchor Link

• One database per connection string.
• No point-in-time recovery or incremental backups. Every backup is a full copy.
• No private networks or SSH tunnels.
• A dump that sends no data for 5 minutes is stopped.