How PostgreSQL backups work
WAL archiving with pgBackRest, the settings Rowsafe changes, and where files live.
On PostgreSQL, Rowsafe uses pgBackRest (open source) and PostgreSQL's write-ahead log (WAL).
WAL archiving
PostgreSQL writes every change to its WAL, in 16 MB segments. With archiving on, it hands each finished segment to archive_command and only recycles it once that succeeds. Rowsafe's archive_command is pgBackRest, which compresses, encrypts and uploads it:
/usr/bin/pgbackrest --config=/etc/rowsafe/pgbackrest/app.conf --stanza=app archive-push %pPostgreSQL archives by itself, so it keeps working while the agent or Rowsafe is down.
The settings Rowsafe changes
At most four, with ALTER SYSTEM (in postgresql.auto.conf):
| Setting | Changed to | When | Needs a restart |
|---|---|---|---|
archive_mode | on | unless it is already on or always | Yes |
archive_command | the pgBackRest command above | always | No |
archive_timeout | 60 (seconds) | if it is 0 or more than 60 | No |
wal_level | replica | only if it is minimal | Yes |
Rowsafe reloads the configuration but never restarts on its own: restart when it suits you, at install, or with Restart in the dashboard if you allowed it. Rowsafe notices.
archive_timeout = 60means at most about a minute of loss on a quiet database. Mostly empty segments compress to little.- Older setups with
300keep it until you click Apply fix on "Backups can be up to 5 minutes behind" (no restart). - If another tool already archives (
archive_commandorarchive_libraryset), the plan refuses without--force. Adopt an existing database.
Backups with pgBackRest
pgbackrest backup runs while PostgreSQL runs, without locking tables. Each database is one pgBackRest stanza of the same name, configured with:
aes-256-cbcencryption with your passphrase, on your serverzstdcompression, bundling and block-level incremental backups- retention by count of full backups (
--retention-full, default 2) - two parallel processes at low CPU and IO priority
Where things live
In your bucket, each database under /rowsafe/<name> by default, all encrypted:
rowsafe/app/archive/ the WAL archive
rowsafe/app/backup/ full and differential backupsOn your server:
| Path | What |
|---|---|
/etc/rowsafe/agent.env | Agent settings, including bucket keys and passphrase. Mode 0600, owned by postgres. |
/etc/rowsafe/pgbackrest/<name>.conf | Generated pgBackRest config. Mode 0600. Rewritten before every task, so local edits are lost. |
/var/lib/rowsafe/ | Agent identity and state, and Proof's scratch copies while they run. |
/var/log/rowsafe/ | pgBackRest logs, rotated daily. |
/opt/rowsafe/ | Agent binaries. |
Every setting: Agent configuration.
Requirements
- PostgreSQL 13 to 18, a primary (not a standby).
- The agent connects as
postgresover the Unix socket (peer authentication), with superuser rights. - pgBackRest 2.55.0 or newer for PostgreSQL 18. The installer adds it if missing; tested with the current apt.postgresql.org release.
- In Docker, pgBackRest runs in a sidecar container. Run the agent in Docker.