Database Backups

A database backup job connects to your server via SSH and runs pg_dump (PostgreSQL) or mysqldump (MySQL/MariaDB), piping the output through gzip compression and directly into your storage provider — no temporary files, no disk usage on the server.

How It Works

HetGuard opens an SSH connection to your server and executes the dump command. The dump output is streamed in real time to your storage provider as a .sql.gz file. The path in your bucket follows the pattern databases/{job-id}/{timestamp}_{db-name}.sql.gz.

Database credentials are stored encrypted in HetGuard and passed directly to the dump command over SSH. They are never written to disk and do not appear in any log output.

Prerequisites

• A storage provider configured and verified — see Storage Providers.
• An SSH key added in Settings with login access to the server.
• The dump tool (pg_dump or mysqldump) must be installed on the server.
• The database user must have read access to the target database (e.g. SELECT privilege on all tables for MySQL, or CONNECT + SELECT for PostgreSQL).

Creating a Database Backup Job

1. 1
   Go to Schedules → New schedule

   Click Schedules in the sidebar, then New schedule.

2. 2
   Select job type: Database backup

   Choose Database backup from the job type selector.

3. 3
   Choose a server and SSH key

   Select the server and the SSH key HetGuard will use to connect.

4. 4
   Enter database details

   Select PostgreSQL or MySQL, then enter the database name, user, password, and port (defaults to 5432 for PostgreSQL, 3306 for MySQL). The host is always 127.0.0.1 — HetGuard connects through the SSH session.

5. 5
   Choose a storage provider

   Select where backup files should be stored.

6. 6
   Set a schedule and retention count

   Pick a frequency and how many backup files to retain. Older files are removed from storage automatically after each successful run.

7. 7
   Optionally enable encryption

   Enable Encrypt backups and enter an encryption key to encrypt the dump before it is uploaded. The key is never written to disk. Store it securely — lost keys mean unrecoverable backups.

Supported Database Types

PostgreSQL

HetGuard runs pg_dump with your credentials via PGPASSWORD. The output is piped through gzip before upload. The database user needs at minimum read access to all tables you want backed up. A superuser or a user with the pg_dump privilege works without any extra configuration.

MySQL / MariaDB

HetGuard runs mysqldump with the -u and -p flags. The output is piped through gzip. The database user needs SELECT, SHOW VIEW, TRIGGER, and LOCK TABLES privileges on the target database.

Viewing Backup Runs

Click the schedule on the Schedules page to open the job detail view. Each run shows its status, compressed file size, duration, and timestamp. Expand any row to view log output from that run.

Downloading a Backup File

A download icon appears on successful runs. Clicking it generates a signed URL valid for 60 minutes and opens it in a new tab. Downloads come directly from your storage provider — no data passes through HetGuard's servers.

Restoring a Database Backup

HetGuard can restore a database backup directly to your server via SSH, either overwriting the existing database or restoring to a new database name. See Restores for full details.