Scheduled backups and a restore test

teseladb admin backup takes a consistent backup of the whole cluster without stopping writes. This guide schedules it every night and checks that a backup can be restored.

1. The script

Save it as /usr/local/bin/teseladb-backup.sh on one of the nodes and make it executable. With --dbpath, the CLI presents itself with that node's certificate:

#!/bin/sh
set -eu
DEST="/backups/$(date -u +%Y-%m-%dT%H%M)"
teseladb admin --dbpath /var/lib/teseladb backup --at now --out "$DEST"
# Keep 14 days of backups.
find /backups -mindepth 1 -maxdepth 1 -type d -mtime +14 -exec rm -rf {} +

Each backup is a folder with the files of each range and manifest.bson, which keeps the SHA-256 of each file.

2. The timer

# /etc/systemd/system/teseladb-backup.service
[Service]
Type=oneshot
ExecStart=/usr/local/bin/teseladb-backup.sh

# /etc/systemd/system/teseladb-backup.timer
[Timer]
OnCalendar=*-*-* 03:00:00 UTC
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl enable --now teseladb-backup.timer

3. Test the restore

A backup you have never restored is not a backup. Start an empty node on another machine or directory and restore into it:

teseladb start --dbpath /tmp/test --port 28017 --peer-listen 127.0.0.1:28100 --admin-listen 127.0.0.1:28200 &
teseladb admin --node 127.0.0.1:28200 --dbpath /tmp/test restore --from /backups/2026-11-03T0300

restore checks the SHA-256 of every file before touching anything and only works on an empty cluster. Then compare counts with mongosh against port 28017.

4. Watch that they run

Check systemctl list-timers teseladb-backup.timer and alert if the newest folder in /backups is more than a day old.