baastide recovery

Restore a bare metal snapshot from the recovery media

Synopsis

Restore a bare metal snapshot from the Linux recovery media, without an enrolled agent. Missing --server and --ca-pin values are read as separate lines from stdin. The CA pin is the lowercase SHA-256 of the DER CA certificate.

The command prints a JSON ready_to_pair line on stdout, then shows a pairing code. A user of the portal types the code, chooses the snapshot and the target disk, and approves. The media then shows the plan and asks for the name of the target disk: the restore erases this disk. For a Linux backup on several disks, the media also asks for the target disk of each other source disk, and for a new passphrase when the backup has LUKS volumes. The pairing key, the repository key and the data plane token stay in process memory. No files are written, except to the confirmed target disks.

Exit status

Exit status is 0 only after a successful restore: the disk is written and synced, the volumes the restore mounted are unmounted, and a JSON restore_succeeded line was printed. Exit status is 1 for invalid input, unsupported OS, an I/O error or a failed restore (JSON restore_failed line). Exit status is 130 for cancellation (SIGINT or SIGTERM).

baastide recovery [flags]

Examples

  baastide recovery
  baastide recovery --server https://backup.example.com --ca-pin <64-lowercase-hex-digits>

Options

      --ca-pin fingerprint   CA certificate SHA-256 fingerprint (prompt if omitted)
      --efi-boot-entry       write a UEFI boot entry for the restored system (efibootmgr)
  -h, --help                 help for recovery
      --no-grow              keep the size of the Windows partition on a larger disk
      --server origin        instance HTTPS origin (prompt if omitted)