> ## Documentation Index
> Fetch the complete documentation index at: https://docs.polystack.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Ironcore Backup Solution Admin Guide

> Deploy, configure, and operate Ironcore Backup Solution — provision datastores, define retention, set up cross-site replication, integrate tape, and harden security.

<p style={{ fontSize: '1.25rem', fontWeight: 700, marginBottom: '0.75rem' }}>Overview</p>

Ironcore Backup Solution (IBS) is the platform-wide service for backing up and restoring
compute instances, system containers, and physical hosts. As an administrator you provision
backup datastores, configure retention policies, define replication targets, integrate
tape libraries and object storage backends, and govern access through roles and tokens.

This guide covers the full administrative lifecycle — initial deployment, day-to-day
operations, and tuning IBS for production workloads.

<Warning>
  All operations in this guide require administrator privileges. Changes to retention
  policies, datastore configuration, and replication jobs affect data already protected.
  Validate every policy change against the **Prune Simulator** before applying.
</Warning>

<Tabs>
  <Tab title="Deployment Console" icon="gauge">
    <Steps titleSize="h3">
      <Step title="Open the Deployment Console" icon="settings">
        Log in to **the deployment console** (`https://the-deployment-console.<your-domain>`)
        and navigate to **Configuration**.
      </Step>

      <Step title="Enable Backup Solution" icon="toggle-right">
        Select the **Advanced Features** tab. Toggle **Enable Backup Solution** to **Yes**.

        This provisions the backup server, default local datastore, and the integration
        with the Ironcore platform without any manual file editing.
      </Step>

      <Step title="Save and Deploy" icon="play">
        Click **Save Configuration**, then go to **Operations** and run **deploy** or
        **reconfigure**.

        <Check>The IBS service starts. The default datastore is registered and reachable via the Dashboard.</Check>
      </Step>
    </Steps>
  </Tab>

  <Tab title="CLI" icon="terminal">
    Enable IBS by setting the flags in the globals configuration and deploying.

    ```bash title="Create IBS globals override" theme={null}
    cat > /etc/ironcore/globals.d/_50_backup.yml << 'EOF'
    enable_backup_solution: "yes"
    backup_default_datastore: "ibs-primary"
    EOF
    ```

    ```bash title="Deploy the Backup Solution service" theme={null}
    ironcore-ansible deploy -t backup
    ```

    <Check>The IBS API, scheduler, GC worker, and verification worker are running on all backup nodes.</Check>
  </Tab>
</Tabs>

***

<p style={{ fontSize: '1.25rem', fontWeight: 700, marginBottom: '0.75rem' }}>In This Guide</p>

<CardGroup cols={4}>
  <Card title="Architecture" icon="layers" href="/services/ironcore-backup/admin-guide/architecture" color="#bf9667">
    Component diagram, data flow, change tracking, deduplication, and encryption layers.
  </Card>

  <Card title="Datastores" icon="database" href="/services/ironcore-backup/admin-guide/datastores" color="#bf9667">
    Create local, replicated, and S3-backed datastores. Organise data into namespaces.
  </Card>

  <Card title="Retention Policies" icon="calendar-days" href="/services/ironcore-backup/admin-guide/retention-policies" color="#bf9667">
    Configure daily, weekly, monthly, and yearly retention with the Prune Simulator.
  </Card>

  <Card title="Replication and Sync" icon="arrow-left-right" href="/services/ironcore-backup/admin-guide/replication-sync" color="#bf9667">
    Replicate backups between Primary DC and Backup sites with encryption in transit.
  </Card>

  <Card title="Tape and Object Storage" icon="archive" href="/services/ironcore-backup/admin-guide/tape-and-object" color="#bf9667">
    Integrate LTO tape libraries and S3-compatible object storage for long-term archival.
  </Card>

  <Card title="Access Control" icon="key" href="/services/ironcore-backup/admin-guide/access-control" color="#bf9667">
    Roles, API tokens, multi-factor authentication, and LDAP / Active Directory realms.
  </Card>

  <Card title="Security and Encryption" icon="lock" href="/services/ironcore-backup/admin-guide/security-encryption" color="#bf9667">
    Client-side AES-256-GCM, master-key handling, ransomware protection, and hardening.
  </Card>

  <Card title="Verification and Validation" icon="check" href="/services/ironcore-backup/admin-guide/verification-validation" color="#bf9667">
    Schedule integrity checks and conduct bi-annual mock recovery drills.
  </Card>

  <Card title="Notifications" icon="bell" href="/services/ironcore-backup/admin-guide/notifications" color="#bf9667">
    Send alerts via SMTP, webhooks, and external metric servers.
  </Card>

  <Card title="Infrastructure Sizing" icon="ruler" href="/services/ironcore-backup/admin-guide/infrastructure-sizing" color="#bf9667">
    Plan Primary and Backup site capacity for incremental, full, and archival retention.
  </Card>

  <Card title="Troubleshooting" icon="wrench" href="/services/ironcore-backup/admin-guide/troubleshooting" color="#bf9667">
    Diagnose backup, restore, sync, and verification failures across the stack.
  </Card>
</CardGroup>

***

<p style={{ fontSize: '1.25rem', fontWeight: 700, marginBottom: '0.75rem' }}>Architecture Summary</p>

| Service                 | Role                                                                      |
| ----------------------- | ------------------------------------------------------------------------- |
| **Backup API**          | REST API for backup, restore, datastore, and job management               |
| **Scheduler**           | Triggers backup, sync, and verification jobs based on configured schedule |
| **Garbage Collector**   | Reclaims chunks that no snapshot still references                         |
| **Verification Worker** | Re-reads chunks and recomputes SHA-256 to detect bit rot                  |
| **Replication Worker**  | Mirrors snapshots from Primary to Backup site over an encrypted channel   |
| **Tape Worker**         | Reads / writes LTO tapes; manages barcoded media catalog                  |

***

<p style={{ fontSize: '1.25rem', fontWeight: 700, marginBottom: '0.75rem' }}>Compliance Mapping</p>

| Requirement                               | IBS Capability                           | Configured In               |
| ----------------------------------------- | ---------------------------------------- | --------------------------- |
| Block-level change tracking (CBT)         | Native block-level CBT for running VMs   | Architecture                |
| Full + incremental + file-level restore   | Snapshot model with mountable archive    | Restore Options             |
| Daily Incremental retention (7 days)      | Retention policy `keep-daily=7`          | Retention Policies          |
| Weekly Full retention (3 weeks)           | Retention policy `keep-weekly=3`         | Retention Policies          |
| Weekly archival (52 weeks) at Backup site | Sync job + retention `keep-weekly=52`    | Replication and Sync        |
| Near real-time async replication          | Push / pull sync jobs with throttling    | Replication and Sync        |
| Encryption in transit                     | TLS 1.3 between sites                    | Replication and Sync        |
| Integrity verification of replicated data | SHA-256 verify after sync                | Verification and Validation |
| Deduplication and compression             | Content-defined chunking + Zstandard     | Architecture                |
| Encryption at rest                        | Client-side AES-256-GCM                  | Security and Encryption     |
| Role-based access control                 | Roles, API tokens, restricted-by-default | Access Control              |
| Immutability against modification         | Append-only chunks, no chunk rewrite     | Security and Encryption     |
| Bi-annual mock drill                      | Restore-test job from Backup site        | Verification and Validation |

***

<p style={{ fontSize: '1.25rem', fontWeight: 700, marginBottom: '0.75rem' }}>Next Steps</p>

<CardGroup cols={4}>
  <Card title="Ironcore Backup User Guide" icon="book-open" href="/services/ironcore-backup/user-guide" color="#bf9667">
    Operate IBS from a project member perspective — create backups and restores.
  </Card>

  <Card title="Ironcore Backup Overview" icon="layers" href="/services/ironcore-backup" color="#bf9667">
    Service overview and getting started.
  </Card>
</CardGroup>