The break-glass envelope

Keep a printed recovery sheet separate from the server. Recovering from an encrypted backup requires both the backup and the correct keys; Harbor cannot replace lost keys for you. Anyone with this information and access to your backup may be able to recover your records.

What goes on it#

Use harbor break-glass to display the recovery information. Review the output and complete the following checklist before storing the sheet:

1. The passphrase that unlocks the data volume at boot.
2. The master key, which decrypts every document and every sealed secret, including the authenticator secrets and mail passwords: cat /data/secrets/kek
3. The backup password, which decrypts the snapshots: cat /data/secrets/restic-password
4. Where the backups are, and the credential that reaches them: the RESTIC_REPOSITORY line and the B2 key, the SFTP login, or which disk.
5. Your account recovery codes, saved during first run, if your authenticator becomes unavailable. Keep these with the sheet; do not assume the command includes them.
6. The address of Restore from a backup and the Harbor release you are running.

Where it goes#

In a safe, or with someone you trust in another house. Not on the box, and not in the vault.

When to reprint it#

Whenever any line changes: a new backup target, a rotated key, a new volume after a restore. Replace outdated copies so the information matches your current setup.