Move the database

#Keep the signing keys

Portal encrypts the credentials you save in integrations (tokens, passwords, certificates) with its signing keys. A database restored next to different keys still works, but those credentials can’t be read, and you have to enter them again.

• Docker Compose: the keys are JWT_PRIVATE_KEY, JWT_PUBLIC_KEY and SECRET_KEY in .env. Copy .env and .compose-config.sh to the new server instead of running the installer there.
• Helm: the keys are in secrets.yaml. Install on the new cluster with the same file.

#Back up

#Docker Compose

In the install folder, with Portal running, open sh launcher.sh and choose Backup. The database dump is saved to backups/. It works with your own PostgreSQL server too, if pg_dump is installed on the server. Then back up the uploaded files:

bashCopy
tar czf media.tar.gz -C back/AppSecPortal media

To back up the database every night, add backup-postgres.sh to cron. It keeps the last two dumps (set KEEP to keep more):

Copy
0 3 * * * /opt/portal/backup-postgres.sh

Replace /opt/portal with your install folder.

#Helm

With the bundled PostgreSQL:

bashCopy
kubectl exec -n portal portal-postgres-0 -- \
  sh -c 'PGPASSWORD="$POSTGRES_PASSWORD" pg_dump -U "$POSTGRES_USER" "$POSTGRES_DATABASE"' \
  | gzip > portal.sql.gz

With your own PostgreSQL server, back it up the way you back up your other databases.

#Restore

Restore into the same release you backed up, then update if you need a newer one.

#Docker Compose

1. On the new server, download the install files as in Install, put the .env and .compose-config.sh you copied into the folder, and start it with sh run.sh. Don’t run the launcher before the files are in place: without .env, it starts a new install.

2. Stop everything except the database, and empty it:

   bashCopy
   . ./.compose-config.sh
   compose stop
   compose start postgres
   compose exec -T postgres sh -c 'dropdb -U "$POSTGRES_USER" "$POSTGRES_DB" && createdb -U "$POSTGRES_USER" "$POSTGRES_DB"'

3. Load the backup and the uploaded files, then start everything:

   bashCopy
   gunzip -c portal.sql.gz | compose exec -T postgres sh -c 'psql -q -U "$POSTGRES_USER" "$POSTGRES_DB"'
   tar xzf media.tar.gz -C back/AppSecPortal
   compose start

   A dump from Backup is in backups/, named portal_<date>_<time>.sql.gz.

Log in with the users of the old installation. The license moves with the database.

#Helm

1. Install on the new cluster with the same values.yaml and secrets.yaml.

2. Stop the pods that use the database:

   bashCopy
   kubectl scale deployment -n portal --replicas=0 --all

3. Empty the database and load the backup:

   bashCopy
   kubectl exec -n portal portal-postgres-0 -- sh -c \
     'export PGPASSWORD="$POSTGRES_PASSWORD"; dropdb -U "$POSTGRES_USER" "$POSTGRES_DATABASE" && createdb -U "$POSTGRES_USER" "$POSTGRES_DATABASE"'
   gunzip -c portal.sql.gz | kubectl exec -i -n portal portal-postgres-0 -- \
     sh -c 'PGPASSWORD="$POSTGRES_PASSWORD" psql -q -U "$POSTGRES_USER" "$POSTGRES_DATABASE"'

4. Start the pods again with the same helm upgrade command you installed with.