Search docs.molo17.com

    Backups with Gluesync Connect

    Core Hub can back itself up to Gluesync Connect. It encrypts each backup on the Core Hub host with a recovery key that only you hold, then uploads the encrypted file. Gluesync Connect stores the file. It cannot read it, and neither can MOLO17.

    To bring a backup back, see Restore Core Hub from a backup. To automate the backup, see the Backup REST API.

    This page covers a backup of the whole Core Hub: its databases and files. To export pipeline definitions as YAML files, use Automator. See Backup and restore with Automator.

    What you need

    • A Core Hub that is paired with Gluesync Connect, with its tunnel online.

    • A Core Hub user with the Super Admin role. Other roles cannot see or change the backup settings.

    • A safe place for the recovery key. See Keep the recovery key.

    • Outbound HTTPS from the Core Hub host. Core Hub uploads each backup straight to the storage that Gluesync Connect names, so a firewall or proxy must allow <bucket>.s3.eu-central-1.amazonaws.com on port 443 next to the address of Gluesync Connect. Nothing needs to reach Core Hub from the outside.

    • Free disk space on the disk that holds the Core Hub data folder: about 1.5 times the size of the Core Hub databases, plus room for the encrypted copy.

    What is backed up

    A backup holds the state of Core Hub. It is enough to rebuild the installation on the same host or on another machine.

    Item Content

    Databases

    The main database (gluesync.db: pipelines, agents, connections, users, settings and the Gluesync Connect pairing), the notifications database, the AI Studio database and the Validator database. The metrics database is included only when you turn on Include metrics history.

    Bootstrap file

    bootstrap-core-hub.json, which holds the storage key that encrypts the credentials in the databases.

    License

    gs-license.dat.

    Security configuration

    security-config.json (or the older ssl-config.json) and the keystore file it points to.

    Connection certificates

    The certificate files uploaded for each connection.

    Agent identity

    The bootstrap.json and the certificate files of each agent.

    User-defined functions

    The source files of the functions and UDFs of each pipeline. Build and compiled folders are left out.

    Each database is copied with a consistent snapshot, so Core Hub keeps running while the backup is made.

    What is not backed up

    • Logs. They are large and a restore does not need them.

    • Metrics history, unless you turn on Include metrics history.

    • The data that Gluesync replicates. It stays in your sources and targets.

    • Files outside the Core Hub data folder and the shared configuration folder, such as the Compose files of the kit and the data of other components.

    How end-to-end encryption works

    The recovery key is a key pair. You generate it when you turn backups on, in your browser or with the --generate-recovery-key command:

    • The private half is the recovery key. It looks like GSRK1-XXXXX-XXXXX-…​. It is shown once, in your browser or in the terminal, and nothing else stores it.

    • The public half is sent to Core Hub. Core Hub uses it to lock each backup. A public key cannot unlock anything.

    When a backup runs:

    1. Core Hub copies its databases and files into one archive on the host.

    2. Core Hub encrypts the archive with a new random key, and locks that key with the public half of your recovery key.

    3. Core Hub uploads only the encrypted file. The archive is deleted from the staging folder when the run ends.

    4. Gluesync Connect stores the encrypted file and a few non-secret facts about it: the key ID, the Core Hub version, the database schema versions and the list of contents.

    The recovery key is not derived from your license, your storage key or your Gluesync Connect login. Nothing that MOLO17 or Gluesync Connect holds can open a backup. The encryption is the same on every plan.

    The encryption uses X25519 key wrapping and AES-256-GCM. Each chunk of the file is authenticated, so a file that is damaged, cut short or modified is refused on restore.

    Keep the recovery key

    If you lose the recovery key, you lose the backups sealed to it. MOLO17 cannot recover a key, and cannot open a backup without one.

    • Store the key in a password manager or a company vault, not on the Core Hub host. You need the key when that host is gone.

    • Keep a second copy somewhere else, for example a sealed printout in a safe.

    • Treat the key as a secret. Anyone who has the key and a backup file can read every credential in the backup.

    • Write the key ID next to the key. The Backup screen shows the key ID, and Gluesync Connect shows it next to each backup. It tells you which key opens which backup.

    Plans

    The plan of your Gluesync Connect organization sets how often Core Hub backs up and how long Gluesync Connect keeps the backups. In this page, PRO means any paid plan: Professional, Enterprise or a custom plan.

    Free PRO

    Sites that can back up

    1

    Unlimited

    Frequency

    At most one backup per day

    At most one backup per hour

    Retention

    5 days

    90 days

    Largest backup

    2 GiB

    2 GiB

    Stored per site

    20 GiB

    20 GiB

    The frequency is part of the plan. There is no setting to change it. Core Hub reads the plan from Gluesync Connect and follows it, also after an upgrade or a downgrade.

    On the free plan, one site of your organization can back up. The first site that uploads a backup takes the place. Any other site shows the status unavailable until the place is released in Gluesync Connect, or until you upgrade the plan.

    Turn on backups

    1. Sign in to the Control Plane as a Super Admin.

    2. Open Settings → Backup.

    3. Select Turn on backups.

    4. Read the introduction of Turn on encrypted backups and select Generate recovery key. The Control Plane makes the key in your browser. Core Hub and Gluesync Connect never receive it.

    5. On Save your recovery key, copy the key, or select Download as file (gluesync-recovery-key.txt), and store it as described in Keep the recovery key. The key is shown once.

    6. Type the last 5 characters of the key to confirm that you saved it, then select Turn on backups. Only now does the Control Plane send the public half to Core Hub.

    Core Hub starts the first backup shortly after. The state changes to Backing up, then to Active when the backup is uploaded.

    To turn backups on from a script, generate a key pair with the --generate-recovery-key command and send the public key to the REST API. See Enable backups in the Backup REST API.

    Check the status

    The Backup screen shows the state of backups, the time of the last backup and the time of the next one, and the backups that Gluesync Connect holds for this site. The same information is in GET /backup, where the state has the API value in the first column.

    API value Label on the screen Meaning

    disabled

    Off

    Backups are off.

    waiting_for_connect

    Waiting for Connect

    Backups are on, but Core Hub is not connected to Gluesync Connect right now. Backups resume when the tunnel is back.

    idle

    Active

    Backups are on and healthy. The next backup is due at the time shown.

    running

    Backing up

    A backup is being made or uploaded.

    rate_limited

    Waiting for the plan

    Gluesync Connect asked Core Hub to wait, because your plan allows no backup yet. Nothing is wrong. The next try waits until the time shown.

    error

    Needs attention

    The last attempts failed. The screen shows the last error. Core Hub keeps trying with a growing pause.

    unavailable

    Unavailable

    Gluesync Connect cannot take backups from this site. The message says why. See Troubleshooting.

    Back up now

    Select Run backup now in Settings → Backup, call POST /backup/run, or use the run_backup MCP tool (see Backups and other tools).

    A manual backup is the same as a scheduled one and obeys the same limit. When your plan allows no backup yet, nothing starts and the screen shows the time the next backup is allowed. A scheduled backup is skipped when nothing has changed since the last one. A manual backup is always made.

    Frequency and retention

    Frequency

    Core Hub makes one backup per plan interval: about every 24 hours on the free plan and about every hour on a PRO plan. The time of the next backup is saved, so a restart of Core Hub does not start a backup that is not due.

    Before each scheduled backup, Core Hub checks the size and the modification time of its files. If nothing changed since the last backup, it skips the run and checks again a few minutes later.

    Retention

    Gluesync Connect deletes backups that are older than the retention of your plan: 5 days on the free plan and 90 days on a PRO plan. It runs this clean-up every hour.

    Thinning on PRO plans

    A PRO plan makes up to 24 backups a day. Gluesync Connect keeps them in two layers:

    • all the backups of the last 24 hours (about one per hour);

    • then the newest backup of each day (UTC), until the 90 days end.

    On the free plan there is one backup a day, so there is nothing to thin.

    The last backup is always kept

    Gluesync Connect never deletes the newest backup of a site, even when it is older than the retention of the plan. If backups stop, for example because the site is offline, the last good backup stays.

    Change plan

    Downgrade to the free plan. The new rules apply at the next hourly clean-up, and they are not reversible:

    • Backups older than 5 days are deleted, except the newest one. Download the ones you still need before you downgrade.

    • Core Hub backs up once a day.

    • One site keeps backing up. The first site that asks for an upload after the downgrade takes the place. The other sites show unavailable, and their existing backups age out in 5 days.

    Upgrade to a PRO plan. The limits are lifted at once. Core Hub starts to back up every hour, and the backups that already exist are kept for 90 days.

    Rotate the recovery key

    Rotate the key when it was exposed, when someone who knew it leaves, or on a schedule that your security rules ask for.

    1. Open Settings → Backup.

    2. Select Rotate recovery key.

    3. Generate the new key, save it and confirm it, as when you turned backups on. Select Rotate key.

    Core Hub seals the next backups to the new key. The first backup under the new key is made when the interval of your plan allows it. On the free plan, that can be up to a day. Until then, the newest backup is still sealed to the old key.

    Rotation does not re-encrypt the backups that already exist. They still open only with the key they were sealed to. Keep every old key until the last backup sealed to it has aged out of retention: up to 90 days on a PRO plan.

    Turn off backups

    1. Open Settings → Backup.

    2. Select Turn off backups, and confirm with Turn off backups in the dialog.

    Core Hub stops backing up and forgets the public key. The backups that Gluesync Connect already holds stay until their retention ends. You can delete them earlier from the Backups tab of the site in Gluesync Connect. When you turn backups on again, you generate a new recovery key.

    Include metrics

    The metrics database is large and is rebuilt as the platform runs, so a backup leaves it out. To include it, turn on Include metrics history in Settings → Backup, or call PUT /backup/settings with { "includeMetrics": true }. A bigger backup can reach the size limit of your plan.

    Failures and notifications

    If a backup fails, Core Hub tries again after 5 minutes. Each new failure doubles the pause, up to the interval of your plan. After 3 failures in a row, Core Hub raises one notification: Backups to Gluesync Connect are failing. A new notification is raised only after a backup succeeds and fails again.

    A tunnel that is down, an expired session and a refusal from Gluesync Connect to take backups are not counted as failures. They show as waiting_for_connect, rate_limited or unavailable.

    While a backup runs, Core Hub writes an unencrypted copy of its databases to the backup-staging folder inside its data folder. It deletes the copy when the run ends, however it ends, and again when Core Hub starts.

    Backups and other tools

    The recovery key must be held by a person. For that reason, turning backups on, rotating the key and turning them off are available only in the Control Plane and in the REST API. They are not available through the MCP server, Chronos or Bootstrapper.

    • MCP: two tools. get_backup_status reads the status, the plan limits and the backups in Gluesync Connect. run_backup starts a backup now. Both need a Super Admin. A read-only deployment does not expose run_backup. See Core Hub MCP server.

    • Automator and Bootstrapper: their full backups do not include the backup settings. After you restore a Core Hub from one of them, a person turns backups on again in Settings → Backup, with a recovery key. After a restore made with --restore-backup, the backup settings come back with the rest. See Restore Core Hub from a backup.

    Warnings on the Backup screen

    The Backup screen can show warnings about the installation. They do not stop backups.

    • The storage key is still the default one. The credentials in the databases are encrypted with a key that is publicly known. See Move to production for how the storage key is set.

    • Core Hub runs in DEBUG mode. This mode is meant for development. Do not use it for an installation you want to protect.

    Troubleshooting

    Message on the Backup screen Cause What to do

    Core Hub is not connected to Gluesync Connect right now. Backups resume when it is.

    The Core Hub tunnel is down or Core Hub is not paired.

    Check the connection to Gluesync Connect in the Control Plane. Backups resume by themselves.

    The Gluesync Connect session is not valid. Backups resume once Core Hub is connected again.

    The session of the tunnel ended.

    Wait for the tunnel to reconnect. If it does not, pair Core Hub with Gluesync Connect again.

    This Gluesync Connect offered no https endpoint, so backups cannot be uploaded.

    Gluesync Connect offered no HTTPS address for uploads.

    Contact MOLO17 Support.

    This Gluesync Connect release does not support backups.

    The Gluesync Connect you use is older than the backup feature.

    Contact MOLO17 Support.

    Gluesync Connect has no backup storage set up. Ask the operator of this Connect to enable it.

    The Gluesync Connect you use has no storage for backups.

    Contact the operator of that Gluesync Connect, or MOLO17 Support.

    This plan backs up one site, and another site of your organization holds it. Release it from Connect, or upgrade the plan.

    The free plan allows one site and another site holds the place.

    Release the place in Gluesync Connect, delete the other site, or upgrade the plan.

    The plan allows no backup before <time>.

    A manual backup was asked for before the plan interval ended.

    Try again after the time shown.

    Not enough free disk space for a backup: it needs about <n> MB in <folder> and <m> MB are free

    The disk of the data folder is too full for the copy or for the encrypted file.

    Free space on that disk.

    The backup is <n> MB, more than the <m> MB this plan accepts

    The backup is larger than 2 GiB.

    Turn off Include metrics history if it is on. Contact MOLO17 Support for larger installations.

    The recovery key stored for backups is not valid. Rotate it to set backups up again

    The public key saved in Core Hub is damaged.

    Rotate the recovery key.

    Connect did not accept the backup: <reason>

    Gluesync Connect refused the upload or could not confirm it.

    Read the reason. Core Hub tries again by itself. If it persists, contact MOLO17 Support.