Backups

Tenantry

Tenantry's state is small. Back up these two things together, and encrypt the result:

What	Where	Why
<dir>/.env (default /opt/tenantry/<name>/.env)	host	Admin password hash, session secret and SECRETS_ENCRYPTION_KEY
The tenantry-data volume	Docker volume tenantry-<name>_tenantry-data, mounted on /data	Audit log, client register, consoles, alerts, technicians

One without the other does not restore

Console fleet tokens and alert channel secrets in /data are encrypted with SECRETS_ENCRYPTION_KEY from .env. A restored volume with a new key cannot read them.

Also keep <dir>/compose*.yml, <dir>/tbot.yaml, <dir>/Caddyfile and <dir>/acme/ if present (they are regenerated by install.sh, so this is a convenience).

You do not need to back up:

• The Machine ID identity. If tbot-storage is lost, create a new join token (Security page, last step) and re-run install.sh.
• The certificate. It is re-issued by the acme.sh sidecar.
• Secrets files you already deleted (bot token, tunnel token). Keep the tunnel token in your password manager: Cloudflare shows it again in the tunnel page.

Backup

docker run --rm -v tenantry-acme_tenantry-data:/data:ro -v "$PWD":/backup alpine \
  tar czf /backup/tenantry-data-$(date +%F).tgz -C /data .
sudo cp /opt/tenantry/acme/.env /backup/tenantry-env-$(date +%F)

Replace acme with your instance name. Encrypt the two files (for example with age or gpg) and keep an offline copy.

Restore

On a new or wiped server, restore the files before running the installer. It keeps the secrets it finds in .env.

sudo mkdir -p /opt/tenantry/acme && sudo cp tenantry-env-<date> /opt/tenantry/acme/.env
sudo chmod 600 /opt/tenantry/acme/.env
docker volume create tenantry-acme_tenantry-data
docker run --rm -v tenantry-acme_tenantry-data:/data -v "$PWD":/backup alpine \
  sh -c "cd /data && tar xzf /backup/tenantry-data-<date>.tgz && chown -R 1000:1000 /data"
sudo scripts/install.sh --name acme ...     # the same options as at install

With --teleport-local the installer creates a fresh join token for the existing bot. Otherwise create a new one (variants).

Test a restore before you need it.

Teleport cluster (master bundle)

./backup.sh archives config/ and data/ (hot copy; stop the service for a copy guaranteed to be consistent). data/ contains the certificate authority keys: mode 700, root access, encrypted backups. Details: A new Teleport cluster.

Steward consoles

./backup.sh in the console's bundle makes a consistent copy of the database, the master key and the host files; ./restore.sh restores it. See Publish Steward.

After a suspected compromise

Stop the container, revoke the Tenantry bot (tctl lock --user=bot-tenantry or tctl bots rm tenantry), revoke the console fleet tokens and the alert webhooks, regenerate secrets (--reset-secrets), and review the Teleport roles and applications Tenantry created (tenantry-managed=true). More in Security.