Guide
Coolify Postgres backups, done properly
Coolify ships scheduled database backups to S3 out of the box. Turning them on takes two minutes. Knowing they restore is the part this guide adds.
Turn on scheduled backups
- Add the destination: Settings → S3 Storages → add your bucket (any S3-compatible store works: Backblaze B2, Cloudflare R2, Wasabi, MinIO). Use a bucket-scoped key, not your account key.
- Per database: open your Postgres resource → Backups → add a schedule (cron syntax, e.g.
0 3 * * *), pick the S3 destination, set how many copies to keep. - Run one manually and confirm the object lands in the bucket.
The gotchas
- Retention counts, not days: "keep 7" means 7 files whatever your schedule is. An hourly schedule with keep-7 gives you 7 hours of history.
- The dump runs inside the container with the bundled client tools — fine, until you restore on a machine with older tools. See version mismatches.
- Same-server copies don't count. A backup on the VPS that hosts the database dies with the VPS. The S3 destination is the whole point — use one, off the box.
- Roles and grants beyond the app user aren't in a single-database dump. If you've created extra roles, export them once with
pg_dumpall --roles-only.
Now test one — tonight, not during the outage
Pull the latest object from your bucket and restore it into a throwaway container on your own machine:
docker run -d --name drill -e POSTGRES_PASSWORD=drill -p 5499:5432 postgres:16
pg_restore --no-owner -h localhost -p 5499 -U postgres -d postgres latest.dump
# sanity: does the data look like production?
psql -h localhost -p 5499 -U postgres -c \
"SELECT relname, n_live_tup FROM pg_stat_user_tables ORDER BY n_live_tup DESC LIMIT 10;"
docker rm -f drill
The complete checklist (counts against a manifest, FK validation, probe queries): the 5-step drill.
A drill that runs itself, next to Coolify
pgProof's self-hosted agent is one container on your VPS: dumps on schedule, encrypts locally, pushes to your bucket, then restore-tests every backup and emails the proof. Credentials never leave your server.
Join the early-access waitlist