Skip to main content
Evidence state (2026-09-17, v0.35.0): the Basement Kit backup and restore cycle passed on fresh Ubuntu 24.04 and Debian 13 virtual machines on v0.35.0. For Documents & Files (Cloudreve), the restored bytes match the original, activation completed, and the application readback was verified over the guest-local loopback. For Passwords (Vaultwarden), backup, isolated restore, and restore activation passed on Ubuntu 24.04 amd64 on v0.35.0. For Photos (Immich), they were last verified on v0.33.3. For Passwords and Photos, the application-level readback after restore is pending. Restore evidence on a released archive is pending for Media (Jellyfin) and Smart Home (Home Assistant). Personal AI, Development (Gitea), and Documents (Paperless-ngx) are experimental with no runtime evidence.
The released Basement Kit includes a local, owner-controlled Kopia backup lifecycle. Run it only from the applied StackKits workspace whose data you intend to protect. Make the restore exercise part of the setup, not a later task.

​
Practice recovery before you import important data

  1. Apply and verify the Basement Kit.
  2. Confirm that the primary data and backup roots are separate.
  3. Configure the repository and create a snapshot with the commands below.
  4. Restore that snapshot into isolated staging and review the result.
  5. Verify the services again after any activation. Verification after recovery matters as much as the snapshot.
Repeat the exercise after material storage, workload, or release changes.

​
Configure and check the repository

The repository, source set, exclusions, and local custody are derived from the resolved plan. Do not point the command at an arbitrary volume or bypass owner custody.

​
What a snapshot covers

The plan’s backupPolicy.coverage selects which classes of data the snapshot takes. There are three nested groups, and a stack with no subscription behind it resolves to content: Media is chosen, never inherited. Photo and video libraries dominate a repository, so a first seed will not quietly pull one in: select media when you want it. The status output above reports the exact volumes and exclusions the applied configuration selected, which is the answer to “what will the next snapshot contain”. The coverage group is what the plan asked for; the status output is what one applied configuration resolved to.

​
Create an idempotent snapshot

Store the returned content-addressed snapshot anchor with your verification evidence. Reusing the same operation ID returns the existing operation instead of creating an accidental duplicate.

​
Restore into isolated staging

This verifies and extracts the snapshot into CUE-owned staging. It does not replace live data. Review the returned restore-result ID before continuing.

​
Activate the verified restore

Activation creates the required safety snapshot, switches the exact plan-owned volume set, restarts the runtime, and verifies the owner binding and services. If activation is interrupted, recover the exact operation explicitly:
A successful backup is not recovery proof. Practice the staged restore with non-critical data before relying on the stack for irreplaceable files.