Backing up Talos itself

The database, the encryption key, and the Terraform state.

Back up three things. The second, the encryption key, is the easiest to overlook. Run these in the install folder.

back up
docker compose exec postgres pg_dump -U talos talos > talos.sql
cp .env talos-env-backup          # contains ENCRYPTION_KEY

# Terraform state, if you manage cloud infrastructure through Talos.
# The volume is <project>_talos_terraform (talos_talos_terraform for an installer install).
P=$(sed -n 's/^COMPOSE_PROJECT_NAME=//p' .env); P=${P:-$(basename "$PWD")}
docker run --rm -v "${P}_talos_terraform:/data" -v "$PWD:/out" alpine \
  tar czf /out/talos-terraform.tar.gz -C /data .

A database backup without ENCRYPTION_KEY is unreadable: every SSH key, cloud credential and database password in it stays encrypted under a value you no longer have. A lost Terraform state file orphans real cloud resources that Terraform can then neither see nor destroy.

Restoring

restore into a fresh install, with the SAME .env
docker compose up -d postgres
cat talos.sql | docker compose exec -T postgres psql -U talos -d talos
docker compose up -d