Backup encryption
With backup encryption on, every archive of an instance is locked before it is stored: on every target - FTP, S3, Azure, the containers Backup storage or an Odoo Management Plane manages - and on the server's own disk. A locked archive opens only with a key. Not with the storage provider's credentials, not with access to the bucket, not with a copy of the disk.
The archives use the open age format, so they also open with the free
age tool on any computer, without this console and without a running server.
Nobody can open an encrypted backup without one of its keys - not the server once it is gone, not the storage provider, and not Antelao. Download the server's key when you create it, and keep it somewhere safe and private, such as your password manager. Keep it for as long as you keep the backups it locked.
The keys
Every encrypted archive is locked for the server's backup key, and it can also be locked for an instance key. Either key opens it.
| Key | Who holds it | What it opens |
|---|---|---|
| Server key | You, as the file you downloaded; and the server, as a protected copy it uses for its own restores | Every backup this server encrypts with it |
| Instance key (optional) | The instance's owner | That instance's encrypted backups, and no other |
The server never holds an instance key's secret half: you either let the server make the pair and hand the owner the file once, or the owner makes the pair themselves and gives you only the public key, so their secret key never leaves their computer.
A key is a single line. The secret half starts with AGE-SECRET-KEY-1, the public half with age1.
A key file is a small text file holding the secret line, with the public line as a comment above it.
Setting it up
The Encryption page is in the Backup storage section of the menu, at
/backup-storage/encryption.
- Go to Backup storage > Encryption and press Create server key. Read the warning, then Create the key.
- Download the key file and store it safely. Tick I have stored the key file safely and press Confirm and use this key. The key becomes the server's active key; until you confirm, it locks nothing.
- On each instance's Backup tab, under Encryption, switch Encrypt backups on and save. From the next backup on, the archives are locked. Archives made before stay as they are.
To have every new instance start with its backups encrypted, switch Encrypt new instances on under New instances on the same page. Existing instances are never changed by it.
An instance key
On the instance's Backup tab, under Encryption:
-
Create one for me makes a pair, sets its public half on the instance and offers the key file once. Hand it to the instance's owner. The server keeps no copy: a lost download means making another key.
-
Or paste the owner's own public key in The owner's public key and save. The owner makes it with
age-keygen:age-keygen -o my-backup-key.txtIt prints the public key (
age1...) to give you; the file is theirs to keep.
Remove stops locking new archives for the instance key; the archives already locked keep opening with it.
What it means for restores
Restores on the server that made the backups need nothing from you: the server holds its own protected copy of its key, opens the archive, and restores as it always did. This covers a restore from the Backup tab, the scheduled restores, a restore from another instance, an import and a duplicate.
| Situation | What you do |
|---|---|
| Restore on the same server | Nothing. |
| You pressed Forget the stored key | Import the key file on Backup storage > Encryption first, restore, and forget it again if you want. |
| The server is lost, and you restore on a new one | On the new server, Import a key with the old server's key file. The new server can then restore the old backups; the imported key locks nothing new. |
| An instance moves to another server | Nothing, when the receiving server has a backup key of its own: Move an instance here asks the old server to lock the archive for the new server's key too. Otherwise, or for a move with a backup, import the old server's key on the new one first. |
| A developer workstation pulls an encrypted instance | Import the customer server's key on the workstation first. |
| You have only the archive and the key file, no server | Decrypt it with age or ohm backup decrypt (below) and use the plain zip. |
A restore whose archive no key at hand opens fails before anything is touched, and says which key to import.
An instance that arrives on a server without a key
An instance imported, restored as a new instance or moved here with encryption on, while this server has no backup key, arrives with its encryption switched off: without a key to lock its archives with, every backup of it would fail. Its backups run at once, unencrypted, and this is said on the import's result, under the bell, on the instance's Backup tab and in its Backup encryption health check, until you put it right:
- Create a key on Backup storage > Encryption (see Setting it up).
- Switch Encrypt backups on again on the instance's Backup tab.
Opening a backup without the console
Download the backup with the lock icon (Download encrypted) on the Backup tab, or take it straight from the storage. Then:
With the free age tool - install it once:
sudo apt install age
brew install age
winget install FiloSottile.age
and decrypt:
age -d -i ohm-backup-key.txt -o instance-backup-acme-20261011-020000.zip instance-backup-acme-20261011-020000.zip.age
With the command line, which needs no server and no license:
ohm backup decrypt instance-backup-acme-20261011-020000.zip.age --key ohm-backup-key.txt
The result is the plain zip the backup always was, ready for Restore from backup, an import, or to look inside.
Downloads
On the Backup tab an encrypted archive has two download icons in its row:
- The lock, Download encrypted - the file as it is stored. It opens with its key.
- The download arrow, Download decrypted - the plain zip, decrypted by the server with its own key on the way. Offered only while the server holds a key, and recorded in the audit trail, since a readable copy leaves the server.
A backup that is not encrypted has the download arrow only, since it is a plain zip already.
Replacing, forgetting and importing keys
- Replace server key makes a new key; once you confirm its download, new backups are locked with it. The old key moves to Older and imported keys and keeps opening the backups it locked. Keep its file too.
- Forget the stored key drops the server's copy. New backups are still locked with the key, but a restore or a decrypted download here then needs the key imported again first. This is the stricter way to run: whoever takes over the whole server cannot open the old backups at the provider.
- Import a key takes a key file. A key the server forgot is held again; a key it does not know
- a rebuilt server's old one, or the key of the server an instance came from - is added so its backups restore here.
- Remove a key from Older and imported keys only when no backup you keep was locked with it.
What stays readable
Encryption locks the archive's contents. The file names - which carry the instance's name and the date - their sizes, and the small job files beside them stay readable at the storage.
Under the license
Creating a key and switching encryption on need the backup-encryption feature, in the Professional
and Provider editions. Opening encrypted backups never does: restoring, importing a key, a decrypted
download and ohm backup decrypt work on every edition, including after a subscription ends.