Backing up Talos itself

The database, the encryption key, and the Terraform state.

Three things, and the second one is the one people miss.

back up

docker compose exec postgres pg_dump -U talos talos > talos.sql
cp .env talos-env-backup          # contains ENCRYPTION_KEY

# Terraform state, if you manage cloud infrastructure through Talos
docker run --rm -v talos_terraform:/data -v "$PWD:/out" alpine \
  tar czf /out/talos-terraform.tar.gz -C /data .

A database backup without ENCRYPTION_KEY is unreadable — every SSH key, cloud credential and database password in it stays encrypted under a value you no longer have. A lost Terraform state file orphans real cloud resources that Terraform can then neither see nor destroy.

Restoring

restore into a fresh install, with the SAME .env

docker compose up -d postgres
cat talos.sql | docker compose exec -T postgres psql -U talos -d talos
docker compose up -d

← PREVIOUS

Upgrading