diff --git a/od-db-backup.md b/od-db-backup.md index 5ce9a6e..38e9de5 100644 --- a/od-db-backup.md +++ b/od-db-backup.md @@ -118,6 +118,15 @@ schtasks /Create /TN "OD Nightly Cold Backup" /TR "powershell -NoProfile -Execut - Keep several daily generations plus weekly/monthly rollups; prune old `od-backup-` folders on a schedule. - These files contain **PHI** — encrypt at rest and in transit; restrict access. HIPAA applies. +### Point off-site tools at ``, not at the live database + +Any off-site/cloud replication (Duplicati → Backblaze B2, Veeam, `rclone`, Wasabi, etc.) must use **`` as its source** — it backs up *this backup*. It must **not** re-run the stop/copy against the live ``. + +- The `od-backup-` folders under `` are already a **consistent, cold copy** produced with the service cleanly stopped. Copying *them* off-site is a safe file copy — no service stop, no downtime, no consistency risk. +- Never let a naive file-sync tool crawl the live `C:\mysql\data` directly. A hot copy of a running InnoDB datadir is **corrupt and unrestorable** — the exact failure this runbook exists to avoid. Off-site tools have no idea they need to stop the service first; that's *this* script's job, done once, up front. +- **Sequence:** this cold backup runs first (nightly, off-hours) → the off-site job runs **after** it completes, sourcing ``. Stagger the schedules (e.g. cold backup 23:30, off-site upload 01:00) so the upload never reads a half-written `od-backup-` folder. If your tool supports it, exclude any in-progress/partial folder or upload only completed timestamps. +- Let the off-site tool own its **own** encryption + retention on top — B2/Wasabi object lock or Duplicati's immutability/versioning gives you the ransomware-resistant, off-site copy of the 3-2-1 rule. + --- ## Security note