Restoring
The backup manifest
The encrypted manifest stored next to every backupd backup, with table counts, checksums and tool versions, and how to read it.
Next to every backup file, backupd stores a manifest: a small JSON document, encrypted with age to the same keys as the backup. It records what the backup holds, so you can check a file before you restore it.
Where to find it
In your own bucket, the manifest sits next to the backup with .manifest.age added to the name:
…/<backup ID>.pgdump.zst.age
…/<backup ID>.pgdump.zst.age.manifest.ageIn the app, the table counts from the latest backup's manifest are shown in the database's Explore tab, and each backup's page lists its Contents.
Read it
The manifest is encrypted but not compressed:
age -d -i backupd.agekey app.pgdump.zst.age.manifest.age | jq .Fields
| Field | Meaning |
|---|---|
version | Manifest format version. |
createdAt | When the manifest was written. |
engineVersion | The database server's version. |
toolVersion | The dump tool's version, for example pg_dump (PostgreSQL) 18.1. |
tables | One entry per table or collection: schema, name, rows, bytes, and exact (false when the count is an estimate). |
oplog | MongoDB only: true when the backup includes the oplog. Restore it with --oplogReplay. |
codec | The compression used, zstd. |
plaintextBytes | Size of the dump before compression. |
plaintextSha256 | SHA-256 of the dump before compression and encryption. |
storedBytes | Size of the stored .zst.age file. |
storedSha256 | SHA-256 of the stored .zst.age file. |
durationMs | How long the backup took. |
Check a backup
Check the stored file without decrypting it:
sha256sum app.pgdump.zst.age # compare with storedSha256Check the dump inside it:
age -d -i backupd.agekey app.pgdump.zst.age | zstd -d | sha256sum # compare with plaintextSha256