From a5a36e9a6f90e84847b6ea190ad8fd176816c732 Mon Sep 17 00:00:00 2001 From: Ivan Godwin Date: Sun, 12 Jul 2026 23:23:27 -0700 Subject: [PATCH] od-db-backup: note off-site tools must source , not the live datadir Off-site replication (Duplicati->B2, rclone, Veeam, etc.) should back up the cold-copy output under , not re-crawl C:\mysql\data. The od-backup-* folders are already consistent; a naive hot copy of a live InnoDB datadir is corrupt. Adds sequencing guidance (run off-site job after the cold backup; stagger schedules) and layered off-site encryption/immutability. Co-Authored-By: Claude Opus 4.8 --- od-db-backup.md | 9 +++++++++ 1 file changed, 9 insertions(+) diff --git a/od-db-backup.md b/od-db-backup.md index 5ce9a6e..38e9de5 100644 --- a/od-db-backup.md +++ b/od-db-backup.md @@ -118,6 +118,15 @@ schtasks /Create /TN "OD Nightly Cold Backup" /TR "powershell -NoProfile -Execut - Keep several daily generations plus weekly/monthly rollups; prune old `od-backup-` folders on a schedule. - These files contain **PHI** — encrypt at rest and in transit; restrict access. HIPAA applies. +### Point off-site tools at ``, not at the live database + +Any off-site/cloud replication (Duplicati → Backblaze B2, Veeam, `rclone`, Wasabi, etc.) must use **`` as its source** — it backs up *this backup*. It must **not** re-run the stop/copy against the live ``. + +- The `od-backup-` folders under `` are already a **consistent, cold copy** produced with the service cleanly stopped. Copying *them* off-site is a safe file copy — no service stop, no downtime, no consistency risk. +- Never let a naive file-sync tool crawl the live `C:\mysql\data` directly. A hot copy of a running InnoDB datadir is **corrupt and unrestorable** — the exact failure this runbook exists to avoid. Off-site tools have no idea they need to stop the service first; that's *this* script's job, done once, up front. +- **Sequence:** this cold backup runs first (nightly, off-hours) → the off-site job runs **after** it completes, sourcing ``. Stagger the schedules (e.g. cold backup 23:30, off-site upload 01:00) so the upload never reads a half-written `od-backup-` folder. If your tool supports it, exclude any in-progress/partial folder or upload only completed timestamps. +- Let the off-site tool own its **own** encryption + retention on top — B2/Wasabi object lock or Duplicati's immutability/versioning gives you the ransomware-resistant, off-site copy of the 3-2-1 rule. + --- ## Security note