Backups, Disaster Recovery & Google Drive Integration

Data safety, cryptographic integrity, and zero-loss business continuity are foundational to PanelOps. The upgraded Backup & Restore subsystem provides an end-to-end disaster recovery lifecycle for both the Cloud Control Plane and Customer Self-Hosted Nodes, backed by AES-256-GCM encryption, SHA-256 integrity verification, Google Drive cloud replication, and strict retention locking.

💾 Architecture & Backup Scopes

┌────────────────────────────────────────────────────────────────────────────────────────┐
│                              PanelOps Backup Architecture                              │
├──────────────────────────┬──────────────────────────┬──────────────────────────────────┤
│ Cloud Control Plane      │ Customer Self-Hosted Node│ Managed Databases                │
├──────────────────────────┼──────────────────────────┼──────────────────────────────────┤
│ • MongoDB system schema  │ • Node configuration     │ • MySQL / MariaDB (mysqldump)    │
│ • CMS content & media    │ • Compose deployments    │ • PostgreSQL (pg_dumpall)        │
│ • Registered nodes & keys│ • Persistent volumes     │ • MongoDB (mongodump / driver)   │
│ • Users, plans & billing │ • Isolated from Cloud CP │ • Redis (BGSAVE snapshot)        │
└──────────────────────────┴──────────────────────────┴──────────────────────────────────┘

Supported Scopes

1. Cloud Control Plane (cloud-control-plane): Complete snapshot of administrative metadata, system settings, user accounts, server inventory, and CMS dynamic website configurations.
2. Customer Self-Hosted Node (customer-node): Snapshot of node-level deployment manifests, compose configurations, and persistent application states.
3. Database Container (database): Point-in-time relational or document database dumps with gzip compression.
4. System-Wide Snapshot (system): Full platform recovery archive including all database collections and configuration schemas.

🔒 Cryptographic Security & Integrity Verification

AES-256-GCM Encryption

• Every backup archive is encrypted using authenticated AES-256-GCM before local storage or remote upload to Google Drive.
• Each encrypted archive includes a unique cryptographically random 12-byte Initialization Vector (IV) and a 16-byte GCM Authentication Tag.
• Key Storage: The 256-bit encryption key is stored at data/backup-key with restricted 0600 file permissions or provided via the BACKUP_ENCRYPTION_KEY environment variable. The key is kept strictly separate from the archive payloads.

SHA-256 Checksums & Archive Manifests

• A deterministic SHA-256 checksum is computed across the archive and stored alongside the record.
• An embedded JSON manifest tracks archive version, target scope, included collections, record counts, and timestamps.
• Integrity Auditing: Administrators can verify any backup at any time from the dashboard (/backup/verify/:id). PanelOps validates the SHA-256 checksum, verifies the GCM authentication tag, and parses the gzip structure, setting the integrity status to Verified or Corrupted.

☁️ Google Drive Storage & Logical Isolation

PanelOps integrates directly with Google Drive via the official Google Drive API (googleapis) using the least-privilege https://www.googleapis.com/auth/drive.file scope.

Strict Logical Folder Separation

Google Drive storage is logically compartmentalized into distinct root directories:

• PanelOps-Backups/: Stores private, AES-256-GCM encrypted recovery archives under subdirectories Cloud-Control-Plane/ and Customer-Nodes/.
• PanelOps-CMS-Media/: Stores visual assets for public website branding under Logos/, Hero-Images/, Banners/, Screenshots/, and Favicons/.
• Zero Privilege Bleed: CMS media operations can never inspect, download, or delete backup archives. Backup retention pruning will never delete CMS media assets.

Setting Up Google Drive OAuth

1. Open the Google Cloud Console and create a project.
2. Enable the Google Drive API under APIs & Services → Library.
3. Configure the OAuth Consent Screen (User Type: External, scope: drive.file).
4. Under Credentials, click Create Credentials → OAuth client ID (Application type: Web application or Desktop app).
5. Download credentials.json.
6. In PanelOps, navigate to Backup & Restore (/backup) → Google Drive Settings, upload credentials.json, and click Authorize with Google Drive.
7. Complete the consent flow. The server stores OAuth tokens securely in the database.

🛡️ Retention Policies & Retention Locks

Automated pruning enforces storage quotas and retention schedules while guaranteeing that critical disaster recovery points are never lost:

1. Retention Lock (retentionLock: true): Administrators can lock any backup with one click. Retention pruning will NEVER delete locked archives, regardless of age.
2. Pre-Restore Recovery Points (recoveryPoint: true): Safety snapshots captured immediately prior to restore operations are permanently protected from automated pruning.
3. Last Known-Good Recovery Point: Retention pruning will NEVER prune the single newest successful backup, even if older than the retention threshold.

🔄 Disaster Recovery & Restore Workflow

Restoring an environment from an archive is a guarded, multi-step operation:

[Select Archive] 
       │
       ▼
[Validate Manifest & Integrity Checksum]
       │
       ▼
[Scope Guard: Validate Environment Compatibility]
       │
       ▼
[Require Explicit Destructive Confirmation]
       │
       ▼
[Create Pre-Restore Safety Recovery Point]
       │
       ▼
[Decrypt & Atomic Collection Swap]
       │
       ▼
[Post-Restore Consistency Check & Service Reconnect]

• Scope Isolation: A customer node backup cannot overwrite the Cloud Control Plane, and cross-node restores are blocked unless explicitly authorized.
• Destructive Confirmation: Destructive operations require explicit confirmation in the modal (confirmDestructive: true).
• Pre-Restore Safety Snapshot: Before dropping collections, PanelOps automatically generates a snapshot tagged with recoveryPoint: true. If a restore fails, the pre-restore state is immediately available for rollback.