Deploy Dump Keep

Deploy and Host

Encrypted PostgreSQL backups shipped to Google Drive or any S3-compatible storage. Runs as a cron, encrypts with age, retains by tier.

About Hosting

Dump-Keep is a one-shot CLI tool — it starts, backs up all databases, uploads encrypted dumps, prunes old backups, and exits. It is not a long-running daemon. Railway's cron scheduler triggers it on schedule (default: nightly at 03:17 UTC).

Each invocation:

1. Connects to PostgreSQL, enumerates all non-template databases
2. Dumps globals and each database
3. Streams each dump through age encryption directly to storage — no unencrypted data touches disk
4. Prunes old backup folders based on tier retention
5. Sends notifications on failure (and weekly/monthly success heartbeats)
6. Exits

Why Deploy

• Encryption at source — uses age in recipient mode; the service only holds the public key, so a leak of its environment cannot decrypt any backup
• Two storage backends — Google Shared Drive or any S3-compatible storage (AWS S3, MinIO, Backblaze B2, Cloudflare R2)
• PostgreSQL 15–18 — dumps every non-template database, automatically picks up new ones
• Tiered retention — daily, weekly, and monthly folders with configurable retention, no duplicate copies
• Streamed — pg_dump → age encrypt → upload, without touching disk
• Notifications — Discord and/or Slack webhooks for failures and weekly/monthly heartbeats
• Health checks — optional healthchecks.io pinging for silent-failure detection
• Configurable skip list — skip specific databases via env var or file

Common Use Cases

• Nightly PostgreSQL backups to S3 or Google Drive with automatic retention pruning
• Multi-database instances — backs up all databases automatically, skip specific ones if needed
• Compliance — encrypted backups where the backup service cannot decrypt the data
• Managed Postgres (Railway, RDS, Cloud SQL) — connect via connection string, no agent needed

Dependencies for

• PostgreSQL — a PostgreSQL instance (15–18) accessible from the Railway service. If deploying on Railway, add a Railway Postgres service — POSTGRES_URL auto-connects to it via ${{Postgres.POSTGRES_URL}}. The service needs superuser access for pg_dumpall --globals-only (roles and passwords).
• Storage backend — choose one: Google Shared Drive (requires service account JSON and Shared Drive ID) or S3-compatible storage (requires endpoint, bucket, region, and credentials). Works with AWS S3, MinIO, Backblaze B2, Cloudflare R2.
• age key pair — generate an age key pair before deploying (age-keygen -o key.txt). Set AGE_RECIPIENT to the printed public key (age1...). Store the private key offline — without it, backups are unreadable.

Source: https://github.com/pecataToshev/Dump-Keep