Proof
A weekly automatic restore test, so you know restores work before you need one.
A backup you've never restored is a hope. Proof restores your latest backup every week, checks it, then deletes it.
It runs Sundays at 21:15 UTC by default. To run it now, click Run Proof now on the database's page (or rowsafe proof app).
What Proof does
Checks the disk. It needs about 1.3 × the database size + 1 GiB free, or it fails with not enough disk for a drill.
Restores the latest backup and every archived change into /var/lib/rowsafe/drills/<task-id> on the same server, at low CPU and IO priority.
Starts the copy in isolation: a private Unix socket, no network port. Archiving, replication, background workers and autovacuum are off; transactions are read-only by default.
Compares it with production. Every database must be there, with tables if production has them. A different table count only warns (the schema may have changed since).
Deletes the copy, pass or fail.
In task lists and logs, a Proof run is a drill.
Results
The database's page shows "Proof passed Sunday" (or what failed); Proof history lists every run with its backup, the time it recovered to, and how long it took. That duration is your best estimate of a real restore. CLI: rowsafe proofs app.
A failed Proof, or none passing in 8 days, means not protected and an alert.
Resources
- Disk: about 1.3 × the database size + 1 GiB in
/var/lib/rowsafe/drills(move it withROWSAFE_DRILL_DIR). - Memory: a few hundred MB (about 128 MB shared buffers plus pgBackRest). Out of memory, the kernel stops Proof before production.
- Time: about the same as a real restore.
Not enough disk on the database's server? Run Proof on another server.
Sunday evening busy? Move it in the database's settings, or:
rowsafe set app --proof-schedule "0 4 * * 3" # Wednesdays at 04:00 UTCWhere restore tests run
On the database's Proof tab, Where restore tests run picks the server. Owners and admins change it.
- This server (default).
- Another of my servers, with the free disk and the same engine (for PostgreSQL, the same major version), the agent installed on the server itself (not in Docker) and up to date. You check its key's fingerprint when you pick it: Rowsafe hands it read access to the backups, sealed to that key, as for a fork.
- A temporary Rowsafe Cloud server, for PostgreSQL, MySQL and MariaDB, with pay as you go on. Rowsafe picks the smallest size with enough disk, shows the price per test (billed by the hour, usually about an hour), and deletes the server right after.
While it's set, every Proof runs there, scheduled or Run Proof now. Results show in Proof history as usual, with the server it ran on. Your database isn't touched, and no new database is added or backed up.
Works for PostgreSQL, MySQL, MariaDB, MongoDB, ClickHouse, Redis, Valkey and SQLite. Off the database's server, Proof can't ask production, so the checks that need it (like waiting for the newest changes to reach the bucket, or comparing row counts with production) are skipped. AI agents can't change this setting.