This add-on is operated by Nolasoft Development

Secure Offsite Postgres Backup Designed for Enterprise Applications

Remora Offsite Backup

Last updated 18 June 2018

Overview

Remora Backup is a secure, simple, yet powerful offsite backup service for your Heroku Postgres database. We operate with the belief that your data is the lifeblood of your business, and offsite backups are a must. While Heroku does a great job protecting your data, it’s always a good idea to have an offsite backup. And sometimes it’s not just a good idea, as it’s often a legal requirement for certain industries.

Heroku is built and runs on AWS. With Heroku being an AWS-centric Platform as a Service, we consider offsite to mean “not stored on AWS.” The default Heroku Postgres backups are stored on AWS using the S3 service. The default Heroku Postgres backups are your first line of data protection. We run our businesses on Heroku too, and take full advantage of the Heroku Postgres data protection features. At the end of the day, all data and backups still reside on AWS infrastructure.

We recently built out the infrastructure for a new project using Heroku Private Spaces. While deciding on the architecture, we knew that we’d also need to have a secure, encrypted copy of our data residing completely off AWS infrastructure yet stored in a secure and compliant location. That’s why we built Remora Backup.

With Remora Backup we provide you with a simple, secure backup utility that runs entirely under your control. We accomplish this using a single utility app that we help you provision but that you own and ultimately control - the Remora Helper App. This Helper App is able to reside on the Common Runtime or within a Private (or Shield) Space. The Remora Backup service has access to only this app, and you have full control over which database this app has access to. More on this below. Your database is backed up using the standard Postgres utility pg_dump, then encrypted using the open source encryption utility gpg. Encryption keys are generated and stored using a service backed by Hardware Security Modules. Once a backup has been created and encrypted, it is copied from within your app to our offsite storage via an SSH encrypted connection. Your encrypted backups are then stored using the rock-solid ZFS filesystem, complete with snapshots.

If you need to restore a backup, we provide you with SFTP or SSH access, as well as the key needed to decrypt your backup files.

We’ve built Remora Backup with security, compliance, and simplicity as our top priorities. If you need a BAA for HIPAA compliance, we can do that too.

In short, we’ve created a backup solution we think you’ll come to love and trust.

Provisioning Remora Backup

The simplest and quickest way to get started is to use Remora Backup Heroku Button.

Clicking this button will guide you in creating the Remora Helper App, as well as automatically provision the Remora Backup add-on alongside the new app. Be sure to place this new app in the same location as the database you are backing up. For instance, if your database resides inside a Private Space, the new app must also be inside the Private Space.

This Helper App will be a stand-alone app solely for the purpose of creating offsite backups using the Remora Backup service. For security reasons, our service will have minimal access to this app. We suggest using a name based on your existing app name such as ‘yourapp-backup’ or similar, a name that will remind you of the purpose of the app. It’s best to think of this new Remora Helper App as a utility app for the backup process. No other processes or code are necessary, and the new app will not be running any dynos except for when a backup is scheduled to run.

Once your new app has been created using the Heroku Button process, you’ll need to attach your Heroku Postgres database to it that you wish to back up. This attachment will create a secure connection that the Remora Backup utility will then use for backups.

Configuration

In order for Remora Backup to securely connect to a database and run backups, you will need to provide it with a Postgres connection string. The Remora Backup service will only work with a config variable named REMORA_TARGET_URL, which must be a Postgres connection string added to the newly created Helper App above. Fortunately, Heroku has provided a secure, reliable method for this called Heroku Postgres Credentials. You will need to create a read-only credential on the database you wish to backup, and then attach that credential to the newly created app from above.

Using Heroku Postgres Credentials to create REMORA_TARGET_URL on the new app is important for two reasons. First, it’s secure and reliable. Credentials are stored at the Postgres level and are maintained by Heroku. In the event that your database were to fail and be replaced, the connection details are automatically updated on all apps that have the credentials attached. Second, Remora Backup only needs read-only access to backup your database. We don’t want write access! Heroku Postgres Credentials is the simplest and most secure way to accomplish this.

There are two different ways to configure Heroku Postgres Credentials for use with Remora Backup, depending on where your database resides.

In the examples below, we’ll use ##yourapp## as the name of the main application containing the Postgres database that needs offsite backups, and ##yourapp-backup## will be the name of the newly created Helper App by the Heroku Button from which backups will be run.

Creating the Postgres credential via the Postgres Resources dashboard (Common Runtime & Private Space Databases)

Here’s how to create and attach a read-only credential to your newly created app. This process can be done within the Heroku Dashboard interface.

1. In the Heroku Dashboard, go to the Resources section of your ##yourapp## app: https://dashboard.heroku.com/apps/##yourapp##/resources

2. Find the database you’d like to backup in the Resources list and click on it. This will open the Heroku Data Overview for the database.

3. Click on the Credentials section near the top, next to Overview.

4. Choose the 'Create Credential’ option.

5. Provide the exact name REMORA_TARGET for the credential (note the lack of _URL at the end), and be sure to choose 'Read-only permissions’ in the Initial Permissions drop-down. Note that this step will not work if the ##yourapp## app and database are in a Shield Space. See the next section for details on Shield Space configuration.

6. Once you’ve confirmed creation of the credential, the next step is to attach it to the newly created ##yourapp-backup## app.

7. You should now see your new credential in the list of database credentials, listed along with the default credential.

8. Expand the details of the new credential, and look for the 'Attachments’ section below the connection details.

9. In the 'Select an app’ dropdown you should choose the newly created ##yourapp-backup## app.

10. Click the 'Add Attachment’ button.

Creating the Postgres credential via the command line (Shield Databases)

Heroku Postgres databases running inside a Shield Space are very secure. Many of the access methods available to databases on the Common Runtime or in a Private Space are simply not available to a database within a Shield Space. However, creating a read-only credential for the sole purpose of offsite backups is still possible, but it must be done manually:

1. Find out what the add-on name is for the Postgres database attached to your ##yourapp## app. The heroku pg:info --app ##yourapp## command will show information about your database, and you’re looking for a string similar to Add-on: postgresql-sunny-1234. This is your Heroku Postgres add-on’s name, and you’ll use this name in the next step (referred to as ##postgres-addon-name## below).

2. Create the credential by running this command on the ##yourapp## app: heroku pg:credentials:create ##postgres-addon-name## --name remora_target --app ##yourapp##. Be sure to use --name remora_target exactly.

3. Next, you will need psql access to your database. The easiest way to get this is the heroku run bash --app ##yourapp## command.

4. When you have a bash prompt ready, connect to your database with the psql $DATABASE_URL command. This command should connect you directly to your database, from which you will be able to define the read-only permissions of the newly created credential. The following commands should be run one-by-one to grant read-only access to the remora_target credential:

   GRANT USAGE ON SCHEMA public TO remora_target;
   GRANT SELECT ON ALL TABLES IN SCHEMA public TO remora_target;
   GRANT SELECT ON ALL SEQUENCES IN SCHEMA public TO remora_target;
   ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON TABLES TO remora_target;
   ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT SELECT ON SEQUENCES TO remora_target;
   

5. At this point you can exit psql with \q, then exit the one-off dyno via exit.

6. The last step is to attach the new credential to the ##yourapp-backup## app with this command: heroku addons:attach ##postgres-addon-name## --credential remora_target --as REMORA_TARGET --app ##yourapp-backup##.

That’s it! The Remora Backup service now has read-only access to the database you’ve chosen.

Setting when to run the backups

The final step is to visit the Remora Backup Dashboard to choose what time you’d like backups to run. To get there:

1. Go to your newly created Remora Backup Helper app.

2. Go to the Resources tab

3. Click on the Remora Backup add-on.

This will take you to the Remora Backup dashboard where you can choose the time of day you’d like backups to run.

Accessing your backups

The Remora Backup Dashboard provides your username, password, and host details in the 'Accessing Your Backups’ section. The simplest way to access your backups is to use an SFTP capable program such as Transmit for macOS. You can also use the command line to access your account, via sftp or scp.

Here’s how you can view the size of your current backup (1234 is an example login ID - our dashboard provides you the actual login ID for your account) :

$ ssh 1234@backup.remorabackup.com -t ls -lh
Password:
total 39084
-rw-r--r--  1 1234  1234    19M May  2 02:51 db_backup.tar.gz.gpg
Connection to backup.remorabackup.com closed.

And here’s how to download the latest backup to your local machine using scp (again assuming a login ID of 1234):

$ scp 1234@backup.remorabackup.com:db_backup.tar.gz.gpg .

Remora Backup runs daily and stores a single file - db_backup.tar.gz.gpg - which is then kept in weekly, monthly, and yearly snapshots. If you need the latest backup, simply download the db_backup.tar.gz.gpg file you see when first connecting to your account via the utility of choice.

If you need to download a previous backup stored in one of the snapshots, browse to the .zfs/snapshot/ directory and pick the correct snapshot to download. These snapshots are maintained by the ZFS filesystem and are read-only.

Once you have a backup downloaded, you will need to decrypt it using gpg before you can uncompress and make use of it. If you’re not familiar with gpg you can find more information here, including instructions on how to install locally. You can find your decryption key in the Remora Backup Dashboard in the 'Your Decryption Key’ section. Here you’ll be able to view the plaintext encryption key that can be used by gpg:

gpg --decrypt --output db_backup.tar.gz db_backup.tar.gz.gpg

After this, you’re free to make use of the backup as you see fit, including restoring it via the standard Postgres pg_restore utility.

Migrating between plans

During the Public Beta phase it’s not possible to change plans.

Security, HIPAA, and compliance

Our secure hosting partner is HIPAA, PCI and SSAE16/SAS70 compliant, and our add-on is designed so your data flows directly from your Private or Shield Space in Heroku to them, never passing through a third-party unsecured. Additional info can be provided upon request.

Removing Remora Backup

If you need to remove the Remora Backup add-on, please be sure you have downloaded any and all backups you’d like to save. Though we don’t immediately delete your backups upon add-on removal, we do delete them within a few hours.

Support

We’re here to help! We realize that in an emergency, getting access to your backups is critical. If for some reason you’re not able to access or download a backup using the process detailed above, let us know via a Heroku Support Ticket. We can even arrange to have your data physically delivered to you in the event of an emergency.