Backup, upgrade and keys

Edition: Community and Enterprise Offering: Self-managed

What to back up

What	Where it lives	How	When
The metadata store	The meta-data volume	pg_dump, plus continuous archiving for a short recovery point	At least daily
The executor's keys	The executor-keys volume, or your HSM	The archive command below, or the HSM's own backup	Once, and after every key change
The configuration	sealfix.yaml, the *.env files, git-keys/, siem-tls/	A copy under your policy for secrets	With every change

docker compose exec -T meta-pg sh -c \
  'pg_dump --format=custom -U "$POSTGRES_USER" "$POSTGRES_DB"' > sealfix-meta.dump

The executor's keys cannot be recovered

Without them nothing sealed can be opened: fixes that have not run cannot run, and fixes that ran cannot be rolled back. No backup of the metadata store replaces them. Keep retired keys for as long as anything sealed with them may still need opening.

docker run --rm --user 0 -v sealfix_executor-keys:/keys:ro -v "$PWD":/backup \
  sealfix:<version> tar czf /backup/executor-keys.tgz -C /keys .

Upgrade

Prerequisites: a fresh backup of the metadata store, and the new bundle verified and loaded (Install, steps 1 and 2).

SEALFIX_IMAGE=sealfix:<new version> docker compose up -d --pull never

migrate runs before api and executor start, so the schema is current before either connects. Read the release notes first: they list anything you must do.

Keys

Key	Held by	Used for
Executor key pair	Executor (private), API (public)	Sealing values and before-images
Checkpoint signing key	Executor, derived from its key	Signing audit checkpoints
Approver passkeys	Each approver's authenticator	Signing approvals
Git signing key	gitsync	Signing commits
SIEM client certificate	siem	Mutual TLS to your syslog receiver

In the Enterprise edition, the executor's keys can live in an HSM through PKCS#11, generated in the token and never extractable.

If a key may be exposed, follow the key compromise procedure in the repository (docs/how-to/key-compromise.md). Sealed values and before-images cannot be re-sealed under a new key, so keep the old private key, offline, for as long as anything sealed with it may need opening.