GeezerVison

PostgreSQL backup tool

Databasus is a free, open source and self-hosted tool to backup PostgreSQL. Make backups with different storages (S3, Azure Blob Storage, FTP, etc.) and notifications about progress (Slack, Discord, Telegram, etc.). With a focus on Point-in-Time Recovery at low RPO/RTO

English • Русский • Español • Português • 中文 • Français • Bahasa Indonesia

Features • Installation • Usage • License

🌐 Databasus website

• Physical: file-level copy of the entire database cluster over PostgreSQL native incremental backups mechanism (read more)
  • Full: a complete, self-contained copy of the cluster
  • Incremental: stores only what changed since the previous full backup, so backups stay small and fast
  • WAL streaming: continuously captures the database write stream, enabling Point-in-time recovery (PITR). Designed for disaster recovery and near-zero data loss
• Logical: native dump of the database in its engine-specific binary format (compressed, suitable for parallel restore)

• Flexible scheduling: hourly, daily, weekly, monthly or cron
• Precise timing: run backups at specific times (e.g., 4 AM during low traffic)
• Smart compression: 4-8x space savings with balanced compression (~20% overhead)

Databasus performs a real restore to confirm backups are usable, not just intact on disk or checksum check.

• Triggers: after each backup or on a flexible schedule (hourly, daily, weekly, monthly or cron)
• Real restore: spins up a database container, runs the restore and checks the restored size against the backup
• Report: lists every table with its row count
• Optional notifications: send the report or failure-only alerts through any configured notifier

• Time period: Keep backups for a fixed duration (e.g., 7 days, 3 months, 1 year)
• Count: Keep a fixed number of the most recent backups (e.g., last 30)
• GFS (Grandfather-Father-Son): Layered retention — keep hourly, daily, weekly, monthly and yearly backups independently for fine-grained long-term history (enterprises requirement)
• Size limits: Set per-backup and total storage size caps to control storage usage

• Local storage: Keep backups on your VPS/server
• Cloud storage: S3, Cloudflare R2, Azure Blob Storage, NAS, FTP, SFTP and more
• Secure: All data stays under your control

• Multiple channels: Email, Telegram, Slack, Discord, Teams, Mattermost, webhooks
• Real-time updates: Success and failure notifications
• Team integration: Perfect for DevOps workflows

• AES-256-GCM encryption: Enterprise-grade protection for backup files
• Zero-trust storage: Backups are encrypted and remain useless to attackers, so you can safely store them in shared storage like S3, Azure Blob Storage, etc.
• Encryption for secrets: Any sensitive data is encrypted and never exposed, even in logs or error messages
• Read-only user: Databasus uses a read-only user by default for backups and never stores anything that can modify your data
• Two-factor authentication: Password sign-in can require a six-digit code emailed to the account. Sign-in through Google or GitHub keeps relying on the provider's own checks

• Workspaces: Group databases, notifiers and storages for different projects or teams
• Access management: Control who can view or manage specific databases with role-based permissions
• Audit logs: Track all system activities and changes made by users
• User roles: Assign viewer, member, admin or owner roles within workspaces
• OpenTelemetry logs: Export application and audit logs to an external system (by default they are also written to a local file)

• Designer-polished UI: Clean, intuitive interface crafted with attention to detail
• Dark & light themes: Choose the look that suits your workflow
• Mobile adaptive: Check your backups from anywhere on any device

• PostgreSQL: 14, 15, 16, 17 and 18 (physical and logical)
• MySQL: 5.7, 8.0, 8.4, 9 and 26 (logical only)
• MariaDB: 5.5, 10, 11, 12 and 13 (logical only)
• MongoDB: 4.2+, 5, 6, 7, 8 and 9 (logical only)

• Docker-based: Easy deployment and management
• Privacy-first: All your data stays on your infrastructure
• Open source: Apache 2.0 licensed, inspect every line of code
• Build-in SSH: Connect to your databasus via SSH tunnel

You have four ways to install Databasus:

• Automated script (recommended)
• Simple Docker run
• Docker Compose setup
• Kubernetes with Helm

You have four ways to install Databasus: automated script (recommended), simple Docker run, or Docker Compose setup.

The installation script will:

• ✅ Install Docker with Docker Compose (if not already installed)
• ✅ Set up Databasus
• ✅ Configure automatic startup on system reboot

sudo apt-get install -y curl && \
sudo curl -sSL https://raw.githubusercontent.com/databasus/databasus/refs/heads/main/install-databasus.sh \
| sudo bash

The easiest way to run Databasus:

docker run -d \
  --name databasus \
  -p 4005:4005 \
  -v ./databasus-data:/databasus-data \
  --restart unless-stopped \
  databasus/databasus:latest

The same image lives on GitHub's registry — use ghcr.io/databasus/databasus:latest if Docker Hub rate-limits your pull.

This single command will:

• ✅ Start Databasus
• ✅ Store all data in ./databasus-data directory
• ✅ Automatically restart on system reboot

Create a docker-compose.yml file with the following configuration:

services:
  databasus:
    container_name: databasus
    image: databasus/databasus:latest
    ports:
      - "4005:4005"
    volumes:
      - ./databasus-data:/databasus-data
    restart: unless-stopped
    healthcheck:
      test: ["CMD", "databasus", "healthcheck"]
      interval: 30s
      timeout: 5s
      retries: 3
      start_period: 60s

Then run:

docker compose up -d

For Kubernetes deployments, install directly from the OCI registry.

Add --set image.repository=ghcr.io/databasus/databasus to any of the commands below to pull image from GHCR instead of Docker Hub.

With ClusterIP + port-forward (development/testing):

helm install databasus oci://ghcr.io/databasus/charts/databasus \
  -n databasus --create-namespace

kubectl port-forward svc/databasus-service 4005:4005 -n databasus
# Access at http://localhost:4005

With LoadBalancer (cloud environments):

helm install databasus oci://ghcr.io/databasus/charts/databasus \
  -n databasus --create-namespace \
  --set service.type=LoadBalancer

kubectl get svc databasus-service -n databasus
# Access at http://<EXTERNAL-IP>:4005

With Ingress (domain-based access):

helm install databasus oci://ghcr.io/databasus/charts/databasus \
  -n databasus --create-namespace \
  --set ingress.enabled=true \
  --set ingress.hosts[0].host=backup.example.com

For more options (NodePort, TLS, HTTPRoute for Gateway API), see the Helm chart README.

1. Create the first account: Navigate to http://localhost:4005 and sign up. The first account created on an instance administers it
2. Add your first database for backup: Click "New Database" and follow the setup wizard
3. Configure schedule: Choose from hourly, daily, weekly, monthly or cron intervals
4. Set database connection: Enter your database credentials and connection details
5. Choose storage: Select where to store your backups (local, S3, Azure Blob Storage, etc.)
6. Configure retention policy: Choose time period, count or GFS to control how long backups are kept
7. Add notifications (optional): Configure email, Telegram, Slack, Mattermost or webhook notifications
8. Save and start: Databasus will validate settings and begin the backup schedule

If you need to reset the password, you can use the built-in password reset command:

docker exec -it databasus ./main --new-password="YourNewSecurePassword123" --email="[email protected]"

Replace [email protected] with the actual email address of the account whose password you want to reset.

If you do not remember which address administers the instance, list the administrator accounts:

docker exec -it databasus ./main --list-admins

The output names every administrator account with its email address, display name, creation date and active state, and marks the one the instance recognizes as its administrator. It prints no password material.

To provision an account without signing up in the browser, for example from a deployment script, create it from the console:

docker exec -it databasus ./main --create-user --email="[email protected]" --password="YourSecurePassword123" --role=admin

--role is admin or member, the password needs at least 8 characters, and --name optionally sets the display name. On an instance that holds no account yet, the first account must use --role=admin and administers the instance. Running the command again for the same account changes nothing, so a deployment can run it on every rollout; rotate the password with --new-password.

After installation, it is also recommended to backup your Databasus itself or, at least, to copy secret key used for encryption (30 seconds is needed). So you are able to restore from your encrypted backups if you lose access to the server with Databasus or it is corrupted.

See the full security and reliability process.

Before each release, Databasus runs automated checks to reduce the risk of vulnerabilities, data leaks and backups that cannot be restored:

• Security scans check code, dependencies and container images for known vulnerabilities and look for leaked secrets.
• Restore tests run full backup-and-restore cycles against real database containers for every supported engine and major version.
• Release gates require tests, builds and security checks to pass. Open critical CodeQL findings in the release analysis block publication.

Regular Codex Security audits from OpenAI complement these release checks. Report vulnerabilities privately using SECURITY.md; security reports take priority.

This project is licensed under the Apache 2.0 License - see the LICENSE file for details

Join our large community of developers, DBAs and DevOps engineers on Telegram @databasus_community.