Setup

Setting up Backups #

Setting up backups takes three steps: prepare a destination, add it to SynergyCP as a Backup Destination, and run a first backup to confirm everything works.

Three destination types are supported:

Secure Copy via SSH #

1. Prepare the destination server #

Any Linux server (or NAS with SSH access) that SynergyCP can reach over the network will work.

  1. Create a standard user on the destination server. We will use backups as an example — any username works.

  2. In SynergyCP, go to System > SSH Keys and generate an SSH key if you have not already. Copy the public key.

  3. On the destination server, add the public key to the user’s ~/.ssh/authorized_keys file:

    mkdir -p ~/.ssh
chmod 700 ~/.ssh
echo '<paste the public key here>' >> ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

  4. Create a directory for the backups and make sure the user can write to it. We will use /home/backups/scp-db as an example.

SynergyCP only ever authenticates with its SSH key — it will never try a password. If key authentication fails, the backup fails immediately instead of hanging on a password prompt.

2. Add the destination in SynergyCP #

Go to System > Backup Destinations and create a new destination:

Field Value
Name A label of your choice, e.g. Off-site NAS.
Handler Secure Copy (SSH).
Host The destination server’s hostname or IP address.
User The user you created, e.g. backups.
Folder The directory you created, e.g. /home/backups/scp-db.
Backups to keep Optional — see retention. Leave empty to keep everything.

The Host field accepts several formats:

  • backups.example.org — hostname or IPv4 address, default port 22
  • backups.example.org:2222 — custom SSH port
  • 2001:db8::1 — bare IPv6 address, default port 22
  • [2001:db8::1]:2222 — IPv6 address with a custom port

The Folder may be an absolute path (/home/backups/scp-db) or relative to the user’s home directory (scp-db). Missing folders are created automatically on the first backup, as long as the user has permission to create them.

On the first connection, SynergyCP records the destination server’s SSH host key and refuses to connect if it ever changes. If you rebuild the destination server later, see Troubleshooting.

Backblaze B2 #

1. Prepare the bucket and application key #

  1. In your Backblaze account, create a private bucket for the backups, e.g. scp-backups.
  2. Under Application Keys, create a new application key:
    • Allow access to: the bucket you just created (recommended — the key then cannot touch anything else on your account).
    • Type of access: Read and Write.
    • Leave “Allow List All Bucket Names” and file name prefix restrictions off.
  3. Note the keyID and applicationKey shown after creation — the applicationKey is only displayed once.

2. Add the destination in SynergyCP #

Go to System > Backup Destinations and create a new destination with the Backblaze B2 handler:

Field Value
Name A label of your choice, e.g. Backblaze B2.
Handler Backblaze B2.
key_id The application key’s keyID.
application_key The applicationKey secret.
bucket The bucket name, e.g. scp-backups.
folder A path prefix inside the bucket, e.g. panel1 — or / for the bucket root.

The key_id and application_key are stored encrypted with your panel’s secret key, the same way other sensitive credentials in SynergyCP are protected.

A single backup file can be at most 5 GB (Backblaze’s single-file upload limit) — far beyond a typical compressed database backup. If your backups approach that size, use a Secure Copy destination instead and contact support.

Cloudflare R2 #

1. Prepare the bucket and API token #

  1. In the Cloudflare dashboard, go to R2 and create a bucket for the backups, e.g. scp-backups.
  2. Under R2 > Manage API Tokens, create an API token:
    • Permissions: Object Read & Write.
    • Specify bucket(s): the bucket you just created (recommended).
  3. Note the Access Key ID and Secret Access Key shown after creation — the secret is only displayed once.
  4. Note your Account ID (shown on the R2 overview page and in the S3 endpoint, https://<account id>.r2.cloudflarestorage.com).

2. Add the destination in SynergyCP #

Go to System > Backup Destinations and create a new destination with the Cloudflare R2 handler:

Field Value
Name A label of your choice, e.g. Cloudflare R2.
Handler Cloudflare R2.
account_id Your Cloudflare account ID.
access_key_id The API token’s Access Key ID.
secret_access_key The API token’s Secret Access Key.
bucket The bucket name, e.g. scp-backups.
folder A path prefix inside the bucket, e.g. panel1 — or / for the bucket root.

The access_key_id and secret_access_key are stored encrypted with your panel’s secret key, the same way other sensitive credentials in SynergyCP are protected.

A single backup file can be at most 5 GB (the single-request upload limit) — far beyond a typical compressed database backup. If your backups approach that size, use a Secure Copy destination instead and contact support.

Run a test backup #

  1. Go to System > Backups and click View All Backups in the Latest Backup box.
  2. At the bottom of the page, select Main Database as the Source and your new destination as the Destination.
  3. Click Create archive and refresh the list after a minute (longer for large installations).

When the backup shows Finished, verify the file arrived. For an SSH destination:

ls -lh /home/backups/scp-db
# main-database.1.gz.enc

The file is encrypted with your panel’s secret key, so it cannot be inspected with gunzip directly — see Restoring from a Backup for how it is decrypted.

For a Backblaze B2 or Cloudflare R2 destination, open the bucket in the provider’s web console and confirm the file is listed under your folder prefix.

If the backup shows Failed, click into it to see the error, and consult Troubleshooting.

Once the test backup succeeds, set up a recurring backup so backups run automatically.

Also make a one-time configuration backup and store it in a separate, secure location (for example your password manager). Without it, database backups cannot be fully restored.