This guide covers everything about Panelica's backup system --- creating backups, scheduling automated backups, configuring remote storage, restoring from backups, managing snapshots, and monitoring backup activity.
Panelica's backup system includes:
- Server Backups --- Full or incremental backups of all domains, databases, emails, DNS, and SSL
- Domain Snapshots --- Point-in-time snapshots of individual domains (Btrfs-based)
- Scheduled Backups --- Automated backup schedules with cron
- Remote Storage --- Sync backups to AWS S3, Google Cloud, Google Drive, SFTP, and more
- Activity Logging --- Full audit trail of all backup operations
---
Go to Backup > Create Backup.
Step 1: Backup Configuration
| Field | Options | Description |
|---|---|---|
| Backup Name | Text | Display name (timestamp appended automatically) |
| Backup Type | Full / Incremental | Full creates a complete backup; Incremental only saves changes since the last full backup |
| Encryption | None / Panel Key / Password | None = unencrypted, Panel Key = AES-256 with system key, Password = AES-256 with your password |
| Compression Level | 1--9 | Higher = smaller file but slower (uses zstd compression) |
Step 2: Select What to Back Up
Toggle individual components:
- Web Content --- All files in domain directories
- Databases --- MySQL and PostgreSQL dumps
- Email --- Email accounts, mailboxes, and configuration
- DNS Records --- Zone files and DNS settings
- SSL Certificates --- All installed certificates and keys
Step 3: Select Domains
Choose which domains to include:
- All Domains --- Back up everything
- Selective --- Pick specific domains from a searchable list
Step 4: Remote Sync (Optional)
If you have remote storage configured, you can enable auto-sync to upload the backup after creation. Select one or more destinations.
Step 5: Click Create Backup. The backup runs in the background --- you can monitor progress from the backup list.
---
Incremental backups only save files that changed since the last full backup. They're much smaller and faster to create.
How it works:
- You must create a full backup first (the "chain root")
- Incremental backups reference this chain root via the backup_name
- Restoring requires both the full backup and all incremental backups in the chain
- The system tracks chains automatically and warns about orphaned backups
Safe Delete: When you delete a full backup that has dependent incremental backups, the system warns you and offers to consolidate the chain or delete orphans.
---
Three encryption modes are available:
| Mode | Algorithm | Key Source | Best For |
|---|---|---|---|
| None | --- | --- | Non-sensitive data, internal backups |
| Panel Key | AES-256 | System encryption key | Routine automated backups |
| Password | AES-256 | Your custom password | Offsite backups, compliance requirements |
Password Requirements:
- Minimum 12 characters
- At least 1 uppercase + 1 lowercase letter
- At least 1 digit
- At least 1 special character (!@#$%^&*)
A strength indicator (weak/medium/strong) appears as you type. Encrypted backups have the
.tar.zst.enc extension.---
Go to Backup > Scheduled Backups.
Create automated backup schedules that run on a cron schedule.
Schedule Configuration:
| Field | Description |
|---|---|
| Schedule Name | Display name for the schedule |
| Backup Name | Prefix for backup filenames |
| Backup Type | Full or Incremental |
| Schedule | Cron format (minute, hour, day, month, weekday) or presets |
| Retention | How many days to keep backups (auto-delete older ones) |
| Max Backups | Maximum number of backups to keep |
| Encryption | None / Panel Key / Password |
| Compression | Level 1--9 |
| Components | Web / Databases / Email / DNS / SSL toggles |
| Domains | All or selective domain list |
| Remote Sync | Auto-upload to configured destinations |
Common Schedules:
- Daily full backup at 2 AM:
0 2 * * * - Hourly incremental:
0 * * * * - Weekly full + daily incremental combination
Each schedule can be enabled/disabled, and shows the last run time and next scheduled run.
---
Go to Backup > Remote Storage.
Configure remote destinations to automatically sync backups offsite.
Supported Providers:
| Provider | Auth Method | Features |
|---|---|---|
| AWS S3 | Access Key + Secret | 15+ regions, storage classes (Standard/IA/Glacier), server-side encryption |
| S3-Compatible | Access Key + Secret | MinIO, DigitalOcean Spaces, custom endpoint URL |
| Google Cloud Storage | HMAC auth | 20+ locations, multiple storage classes |
| Google Drive | OAuth 2.0 | Browser-based authorization flow |
| SFTP | Password or SSH key | Custom port, remote path, key upload |
Setting Up a Destination:
- Click Add Destination
- Select the provider type
- Fill in credentials and configuration
- Click Test Connection to verify
- Save the destination
Each destination shows a connection status indicator. You can test, edit, or delete destinations at any time.
Sync Monitoring:
When backups are syncing, you can see:
- Progress bar with percentage
- Upload speed (MB/s)
- Estimated time remaining
- Current file being uploaded
- Pause/Resume controls
- Retry button for failed syncs
---
Go to Backup > Restore.
Step 1: Select Backup
Choose the backup file from the dropdown. The system shows:
- Backup filename, type, size
- Creation date
- Number of domains included
- Encryption status
Step 2: Restore Options
| Option | Description |
|---|---|
| Full Restore | Restore everything from the backup |
| Selective Restore | Choose specific domains to restore |
| Component Selection | Toggle: Web Content, Databases, Email, DNS, SSL |
| Conflict Action | Skip / Overwrite / Rename --- what to do if a domain already exists |
| Pre-Restore Backup | Create a safety backup before restoring (recommended) |
| Decryption Password | Required for password-encrypted backups |
Step 3: Click Start Restore.
The restore runs asynchronously in the background. A progress bar shows:
- Current phase (validating, decrypting, extracting, restoring databases, etc.)
- Overall progress percentage
- Domain counter (e.g., "2 of 5 domains")
- Estimated time remaining
- Warnings and errors as they occur
Restore Phases:
- Validating --- Checking backup file integrity
- Decrypting --- If password-protected
- Extracting Files --- Restoring web content
- Restoring Databases --- Importing MySQL/PostgreSQL dumps
- Restoring Email --- Setting up email accounts
- Restoring DNS --- Applying DNS zone records
- Restoring SSL --- Installing certificates
- Verifying --- Final validation
- Completed --- Restore finished
---
Go to Backup > Snapshots.
Snapshots provide instant point-in-time captures of domains using Btrfs.
Creating a Snapshot:
- Click Create Snapshot
- Select the domain (or "Server Snapshot" for ROOT)
- Enter a name and optional description
- Click Create --- snapshots are nearly instant
Restoring a Snapshot:
- Find the snapshot in the list
- Click Restore
- Confirm the action
- The domain is rolled back to the snapshot state
Important: Snapshots require a Btrfs filesystem. Check with
df -T /home.Snapshot Settings:
- Auto-snapshot before system changes
- Retention period (default: 7 days)
- Max snapshots per domain
- Compression settings (zstd, gzip, bzip2)
- Storage quota in GB
---
Go to Backup > Activity Log.
Every backup operation is logged with full details:
| Operation | Description |
|---|---|
| backup_create | Server backup created |
| backup_restore | Backup restored |
| backup_delete | Backup deleted |
| backup_upload | Backup uploaded to remote storage |
| snapshot_create | Domain/server snapshot created |
| snapshot_restore | Snapshot restored |
Features:
- Filter by operation type, status, username, date range
- Pagination with 15 items per page
- Statistics dashboard (total, success rate, today/week counts)
- Export to CSV
- Click any entry for full details including warnings and errors
---
Backup operations are rate-limited to prevent abuse:
| Operation | Default Limit |
|---|---|
| Create backup | 5 per hour |
| Restore backup | 3 per hour |
| Download backup | 20 per hour |
| Delete backup | 10 per hour |
| Concurrent restores | 2 maximum |
These limits are configurable in Panel Settings.
Path Traversal Protection: Filenames are sanitized with
filepath.Base() and only .tar.zst / .tar.zst.enc extensions are accepted.---
| Feature | ROOT | ADMIN | RESELLER | USER |
|---|---|---|---|---|
| Create backup | All | Own domains | Own domains | Own domains |
| Restore backup | All | Own domains | Own domains | Own domains |
| Server backup | Yes | Yes | No | No |
| Remote storage config | Yes | No | No | No |
| View all activity | Yes | Own chain | Own | Own |
---
- Follow the 3-2-1 rule --- 3 copies, 2 different media, 1 offsite (use Remote Storage)
- Schedule regular full backups --- At least weekly, with daily incrementals
- Always encrypt offsite backups --- Use Password encryption for remote destinations
- Test restore regularly --- Don't wait for a disaster to find out your backups are broken
- Set retention policies --- Auto-delete old backups to manage disk space
- Enable pre-restore backup --- Always create a safety backup before restoring
- Monitor the Activity Log --- Check for failed backups and address issues promptly
- Use multiple remote destinations --- Different providers for redundancy (e.g., S3 + SFTP)
---
Problem: Backup fails with "insufficient space"
- Check disk space with the Server > Disk Usage page
- Delete old backups or increase disk allocation
- Enable higher compression levels
Problem: Restore fails with "decryption error"
- Verify the password matches the one used during backup creation
- The backup file may be corrupted --- check the file size
Problem: Remote sync stuck at 0%
- Test the connection from Remote Storage settings
- Check if credentials have expired (especially OAuth tokens)
- Verify network connectivity to the remote provider
Problem: Incremental backup shows "no parent found"
- The parent full backup may have been deleted
- Ensure the backup_name matches the chain root
- Create a new full backup to start a fresh chain