Enhance Documentation

# About the Backup role

The Enhance Backup role provides storage space for website backups across your cluster. All backup transfers occur securely over SSH (default SSH port (22).) using incremental hard links to minimize storage usage.

You must have public key authentication enabled in your sshd_config - this is the default on Ubuntu. Password authentication and root login are not required and can be disabled. You can use any file system that supports hardlinks.

Website backups are stored incrementally using hard links to save space. The latest backup is referenced by a symlink with the name current.

# Firewall Rules

If your backup server is behind a hardware or cloud firewall, configure inbound rules to permit traffic from every server in the cluster:

  • TCP Port 22: Standard SSH (transfers website backup data).

  • TCP Port 50000: Enhance control plane communication.

# Security & Encryption Model

  • Inter-Server Communication: Encrypted over the public internet using Mutual TLS (mTLS), requiring two-way trust between client and server before data transfer begins.

  • Data Transfer: User-level data (website backups, server migrations) is strictly isolated to unprivileged SSH user sessions and is always encrypted in transit.

← Installing the Backup Role →