pgBackRest PostgreSQL Backup Host

This is a repackaged open source software product wherein additional charges apply for cloudimg support services.

## Overview

pgBackRest is a reliable, high-performance backup and restore solution for PostgreSQL. This AMI delivers a complete, working backup host built around it - not just a binary install, but a fully configured appliance. It ships PostgreSQL 18 with pgBackRest 2.58.0: an encrypted local repository on a dedicated EBS volume, WAL archiving for point-in-time recovery, scheduled full, differential and incremental backups, and a restore path proven end to end at build time and re-proven on every instance at first boot.

## Why This Image Over a Bare Install

• Fully configured and security-hardened - PostgreSQL binds to loopback only and is never exposed publicly
• Unique credentials per instance - database superuser password and repository encryption passphrase generated on first boot; no shared or default credential ever exists
• Independent backup volume - repository lives on its own EBS volume you can resize and snapshot without affecting the OS disk
• Verified chain - a real backup, verify and restore round trip runs at build time and again on first boot

## What Is Included

• pgBackRest 2.58.0 from the official PGDG repository, signing key verified by full fingerprint
• PostgreSQL 18 pinned to an exact version from the same official repository
• Encrypted (aes-256-cbc) local repository on a dedicated EBS data volume mounted by filesystem UUID
• WAL archiving wired through pgbackrest archive-push for point-in-time recovery
• Scheduled backups on systemd timers - full weekly, differential daily, incremental hourly, repository verification weekly
• Documented restore workflow with a shipped self-test that performs a full backup, verify and restore round trip on demand
• Loopback-only listener, scram-sha-256 authentication, restrictive pg_hba.conf with no trust rules

## Secure First Boot

On first boot a one-shot service generates a cryptographically strong PostgreSQL superuser password and an aes-256-cbc repository encryption passphrase unique to that instance, creates the pgBackRest stanza, takes and verifies an initial full backup, enables the scheduled timers, and writes the secrets to a file readable only by root.

## AWS Integration Points

• Amazon EBS - dedicated repository volume; use EBS Snapshots for an additional off-instance copy or resize independently of the OS disk
• Amazon S3 - repoint the repository at an S3 bucket with a few lines in pgbackrest.conf for off-instance, off-volume storage
• Amazon VPC - deploy within private subnets; PostgreSQL never listens on a public interface, so reach it over an SSH tunnel or bastion
• Amazon CloudWatch - forward PostgreSQL and pgBackRest logs and system metrics for centralized backup monitoring and alerting

## Ready To Use

Connect over SSH, read the generated credentials, and the appliance is already taking scheduled backups. Run sudo -u postgres pgbackrest --stanza=main info to see the backup set, or point the appliance at a remote PostgreSQL host or an S3 repository with a config-only change.

## Use Cases

• Automated PostgreSQL backup and point-in-time recovery - continuous WAL archiving plus scheduled full, differential and incremental backups give you recovery to any moment, not just the last nightly dump
• Disaster recovery and backup verification - an encrypted, independently snapshottable repository with scheduled automatic verification so you learn a backup is good before you need it
• Dedicated backup host for an existing database fleet - repoint pgBackRest at one or more remote PostgreSQL servers and centralize their encrypted backups on one managed, scheduled host

## Getting Started

For evaluation and development workloads, launch an m5.large with the default 64 GB gp3 repository volume. For production, size the repository volume to your dataset and retention policy. A full user guide covering the backup, verify and restore workflow is published on the cloudimg website.

## cloudimg Support

24/7 technical support by email and live chat. Our engineers assist with deployment, pgBackRest and PostgreSQL configuration, backup scheduling and retention design, restore rehearsals, and repointing the repository at remote hosts or object storage. Critical issues receive a one-hour average response time.

All product and company names are trademarks or registered trademarks of their respective holders. This product is not affiliated with or endorsed by Crunchy Data or the PostgreSQL Global Development Group.