TS Pro Backup

TS Pro Backup is a self-hosted server deployed off-site from your Trusted Servants Pro portals. Portals connect via API key to push backup archives, which the server stores with optional end-to-end encryption, enforces grandfather-father-son retention on, and manages through a web console styled to match TS Pro. It handles both whole-site (full) and frontend-only (frontend) backups.

Features

End-to-end encryption (default on) — each site gets an X25519 keypair; the portal encrypts to the public key before upload, so the server holds only ciphertext and rejects unencrypted uploads
Encryption at rest — streaming AES-256-GCM, server-wide or per-site
GFS retention — keep N recent days / weeks / months / years
Hardened console — brute-force lockout, forced first-login password change, non-root container, CSP/HSTS headers, 0600 data files, upload-size and per-site quota caps
Admin / user roles — users manage sites and backups; only admins rotate keys, delete sites or change encryption policy
HTTP API mirroring TS Pro's backup interface (put / list / delete / fetch), with single-shot and chunked uploads
Web console — dashboard, per-site API keys, and a backup browser with download/delete

Requirements

Docker with the Compose plugin, and a TLS reverse proxy in front for production.

Install with Docker Compose

Create docker-compose.yml with the published image:

services:
  tspro-backup:
    image: hyprlab/tspro-backup:latest
    container_name: tspro-backup
    ports:
      - "${TSPB_PORT:-8095}:8000"
    volumes:
      - ./data:/data
    environment:
      - TSPB_SECRET_KEY=${TSPB_SECRET_KEY:?TSPB_SECRET_KEY must be set in .env}
      - TSPB_ADMIN_USERNAME=${TSPB_ADMIN_USERNAME:-admin}
      - TSPB_ADMIN_PASSWORD=${TSPB_ADMIN_PASSWORD:-admin}
      - TSPB_MAX_UPLOAD_MB=${TSPB_MAX_UPLOAD_MB:-8192}
    restart: unless-stopped

Configure .env and start it, then open http://localhost:8095:

cp .env.example .env
python -c "import secrets; print(secrets.token_urlsafe(48))"   # -> TSPB_SECRET_KEY in .env
docker compose up -d

Sign in, change the admin password, configure encryption/retention under Settings, then add a site to get its API key and private key (shown once — store it safely). Point the TSP portal's backup target at https://<host>/api/v1 with that key.

Configuration

Variable	Default	Purpose
`TSPB_SECRET_KEY`	required	Flask session secret
`TSPB_PORT`	`8095`	Host port for the console
`TSPB_REST_PASSPHRASE`	auto	At-rest encryption passphrase (stored at `data/rest.key` if unset)
`TSPB_MAX_UPLOAD_MB`	`8192`	Max backup size
`TSPB_SITE_QUOTA_MB`	`0` (off)	Optional per-site storage quota
`TSPB_TRUST_PROXY`	`1`	Trust `X-Forwarded-*` headers (set `0` if reachable without a proxy)

Updating

docker compose pull
docker compose up -d

Data in ./data persists and schema migrations apply automatically at boot.

Note: the site's private key is the only way to decrypt its archives, and the server never retains it. Lose the key and those backups are unrecoverable by design — store it in a password manager.

License

Free and open source under the GNU AGPL-3.0-or-later. Companion to Trusted Servants Pro · Source on GitHub.