Recover an Appliance from a full Backup

× Magnified Image
Screenshots show the Management frontend with simulated example data. Versions, hostnames, timestamps and status observations do not describe a deployed appliance.

Use the recovery wizard to rebuild an Appliance whose machines were lost. Work as a Management administrator while no Appliance is connected. Use a separate fresh Management instance if the existing one remains connected to an Appliance. Full recovery restores the backed-up release; any later release update is a separate operation.

Prerequisites

Prepare all of these inputs:

  • A completed full Appliance backup. A database-only point is insufficient.

  • The matching artifact bundle, including the private keys required to read that backup.

  • A release bundle for the exact Appliance version recorded in the backup, available in Management’s release sources.

  • The exact Management version and build ID required by the matching release bundle.

  • Replacement machines with signed boot media, enforced Secure Boot, persistent TPM 2.0, CPU AES support, the required disks and network connectivity.

The captured cluster name, application hostname and existing node names remain unchanged. The wizard lets you choose the replacement topology, platform and network. Check replacement resources against the requirements and the release’s supported deployment configuration.

An installed VM’s encrypted disks require its original TPM and EFI state. Preserve them together if restoring or moving that VM. Do not replace its TPM or reset its NVRAM. For replacement hardware, the recovery installation enrolls the destination TPM and restores application data from the protected backup. Prepare VMware replacements from the signed Metal OVA with fresh TPMs and two empty data disks. Prepare Proxmox replacements with the signed noCloud ISO.

Keep any surviving original machines isolated from the replacement deployment. Recovery writes the selected target disks. Verify the full disk identity and destructive confirmation before submitting.

Run Recovery

  1. In Settings > Bundles, upload the full backup for use as a recovery bundle. Retrieve or upload the matching release bundle through bundle management. Stored recovery bundles remain until an administrator deletes them.

  2. Open Installation > Recover and select Start the recovery wizard. Resolve an already-open installation or draft before starting another wizard.

  3. Select the matching release and complete Management preparation before continuing. If Management restarts, sign in and re-enter the recovery settings. In Recovery bundles, select the stored recovery bundle and provide its Matching artifacts bundle.

  4. Select Load recovery settings. Management validates the input before changing target machines. Confirm the displayed Appliance version, cluster name and captured nodes.

  5. Complete the replacement topology, platform and network steps. Discover the replacement machines and select their disks as described in the installation procedure.

  6. Review every target and the recovery settings, then confirm and submit the recovery.

  7. Follow the operation through verification and any GitOps finalization. Download and verify the resulting artifact bundle when prompted and retain it outside Management.

Management keeps the matching artifact upload in memory. Its size limit is 10 MiB. Submit within six hours of loading the recovery settings. After a reload or expiry, select the stored recovery bundle again and supply the matching artifacts; the stored backup remains available.

Verify the restored Appliance

Follow the post-installation checks. Confirm the restored release and Appliance identity, application access, database-backed records expected at the backup’s capture time and HSM connectivity where configured. Check that scheduled backups resume and that a new completed full backup becomes available. Confirm that installed boot verification succeeds with Secure Boot and TPM-backed encryption after reboot.

Expect excluded telemetry history and Grafana UI-created state to be absent. External HSM objects are not recreated from an Appliance backup.

Troubleshooting stopped Recovery

Record the current stage and exact error. Retain the original full backup, artifacts and matching release bundle. Correct missing connectivity or invalid inputs before another attempt. Cancellation does not undo writes already made to target disks. Collect diagnostics and contact support if the recovery cannot complete.