Backups and Restore
Audience: Org Admin, System Admin, Deployment Administrator Related: Cloud Storage · Background Jobs And Schedules · Backups · Sqlite And Postgresql
Blackcap supports local backups and configured Dropbox or Google Drive destinations. Backups are organization-aware where appropriate, include database and filesystem artifacts according to the active database provider, and use restore staging with bounded retention.
SQLite deployments back up the local application database. GCP/PostgreSQL deployments should rely on Cloud SQL backup capabilities for the database while Blackcap backups protect supported application artifacts and organization exports. The default remote folder is host-aware.
Backup destinations
- Local Only
- Dropbox
- Google Drive
Restore safety
Restores use staging, retain a bounded number of staged packages, validate package contents, and apply organization/provider boundaries. Review the job detail when a restore fails rather than manually copying partial database files.
Backups
Blackcap Pi backups include the primary application database:
data/blackcap.dbdata/blackcap.db-walwhen presentdata/blackcap.db-shmwhen present
The backup process attempts a SQLite WAL checkpoint before collecting database files, then still includes sidecar files when they exist.
The database is now canonical for mutable backup control data:
cloud_backup_provider_tokensstores Dropbox/Google Drive provider token payloads encrypted in SQLite.cloud_backup_statestores backup status/history by organization.organization_backup_runsstores backup/export run history, including Default/full platform runs asbackup_scope='platform'.
Legacy token/state files such as cloud_backup/tokens/*.json and backup_state.json are no longer active runtime state.
Filesystem artifacts intentionally included in backups
Backups include source/cache artifacts that are useful or expensive to regenerate:
recipe_cache/or the active organization's scoped recipe-cache foldernoun_cache/or the active organization's scoped downloaded-icon cacheemoji_cache/for full/platform backups- local backup ZIP artifacts when retained by the backup destination
Shopping lists, shopping-list items, and recipe-cart state are also SQLite-only. New backups must not recreate or depend on shopping_lists/.
Noun Project rules are not stored in the icon cache folder; they live in noun_project_rules and are backed up through SQLite.
Filesystem artifacts intentionally excluded from backups
Generated display/render artifacts should not be treated as canonical backup data. They are regenerated by menu, recipe, meal-plan, receiver, and display-content push flows after restore.
Examples:
display_previews/current_view.pngfinal_preview.pngrecipe_preview.pngcurrent_snippet.pnglast_snippet.pngtemp_full.pngocr_preview.pngmenu_crop_preview.pngcloud_backup/restore_staging/migration_backups/__pycache__/
Deprecated current recipe image
recipe_cache/current_recipe_image.png is deprecated and should no longer be created by recipe cache builds. Async cache generation only updates recipe-specific artifacts such as:
recipe_cache/<recipe_id>.pdfrecipe_cache/<recipe_id>.pngrecipe_cache/<recipe_id>_rendered.png
Display-current state should be managed by display render/restore paths, not by background cache generation.
Auth database boundary
data/blackcap.db is the single primary SQLite database. Auth, user, membership, token, security, audit, application, configuration, backup, and Noun Project rule data now live in the same database.
Provider-aware platform backup
SQLite platform backups include the local database and available WAL sidecars. PostgreSQL platform backups contain Blackcap configuration and filesystem artifacts only; Cloud SQL automated backups and point-in-time recovery are the database recovery mechanism. Provider-specific platform backups cannot be restored across backends.
Scheduled backup due state and retention
Automatic backup due state is stored durably in the private internal service-state table and behaves the same on SQLite and PostgreSQL. Manual backups do not reset the scheduled interval. Failed scheduled backups retry after four hours, and a database lease prevents duplicate starts. Backup-history purge protects the newest configured runs per organization/scope/provider/destination plus the latest successful run.