PostgreSQL, MySQL & MongoDB database backups
How database backups work over SSH, and how to configure them correctly.
Database backups connect to your server over SSH and run pg_dump (PostgreSQL), mysqldump (MySQL/MariaDB) or mongodump (MongoDB). The output is compressed and uploaded to your storage destination.
Supported databases
- PostgreSQL (pg_dump) — must be installed on the server
- MySQL (mysqldump) — must be installed on the server
- MariaDB (mysqldump) — compatible with MySQL tooling
- MongoDB (mongodump) — ships in mongodb-database-tools, which is packaged separately from the MongoDB server and often is not installed
PostgreSQL setup
The SSH user needs permission to run pg_dump. The easiest approach is to add the user to the postgres group, or run as the postgres user itself.
# Allow SSH user to run pg_dump without a password prompt
# In pg_hba.conf, add a trust entry for local connections,
# OR create a .pgpass file for the backup user:
echo "localhost:5432:mydb:myuser:mypassword" > ~/.pgpass
chmod 600 ~/.pgpassMySQL / MariaDB setup
Create a dedicated backup user with only SELECT and LOCK TABLES permissions:
CREATE USER 'vpssnaps'@'localhost' IDENTIFIED BY 'strong-password';
GRANT SELECT, LOCK TABLES, SHOW VIEW, EVENT, TRIGGER ON *.* TO 'vpssnaps'@'localhost';
FLUSH PRIVILEGES;Using a minimal-permission backup user is safer than using root. If the credentials were ever exposed, the attacker could only read — not modify — your database.
MongoDB setup
Install mongodb-database-tools on the server — the job checks for mongodump before it runs and fails with that as the reason rather than uploading an empty archive. Then create a user with read on the database you are backing up — or readWrite if you also want to restore onto this server from the dashboard, since mongorestore has to write. If you create that user in admin rather than in the database itself, which is the usual arrangement, set the job's authentication database field to admin: mongodump otherwise authenticates against the database being dumped and a correct password is rejected.
use admin
db.createUser({ user: "vpssnaps", pwd: "strong-password", roles: [ { role: "readWrite", db: "myapp" } ] })MongoDB backups and restores both run on the same schedules, retention and alerting as every other job. mongorestore needs to be present on whichever server you restore onto — it is in the same mongodb-database-tools package as mongodump, and preflight checks for it. A restore is rehearsed with --dryRun before anything is dropped.
What gets backed up
By default, VPS Snaps backs up all databases accessible to the configured user. You can specify individual database names in the job config to back up only those.
Backup file format
Files are named with a timestamp and uploaded to your storage bucket. The SQL engines produce .sql.gz — mydb_2025-06-01T02-00-00Z.sql.gz — which you restore with: gunzip -c file.sql.gz | psql mydb. MongoDB produces .archive.gz, a BSON container rather than SQL, which goes back with: mongorestore --gzip --archive=file.archive.gz --drop