[Question]: Client login

[kayvanaarssen]

Your Question

We are still looking for a solution to have central backups we now have everything setup with backup script local to server fast backups -> Then offload right away with Restic to S3. And this works great battle tested for over 3 years now.
The issue we have at the moment that some of our clients and resellers / parties that have servers managed by us may want to restore backups themself. Which is now not possible, we need to mount with Restic and then put the file somewhere.

Will DBackup have this option at the moment or in the near future?

We would idealy have it that we can give clients access to specific databases and or servers.
Some have a whole server and some just have a site on a shared server. Its then from a client but the developer manages the site, and thus may need to create backups or restore them if needed.

Thanks!

DBackup Version

No response

Additional Context

No response

[Skyfay]

Hey @kayvanaarssen

Thank you for your question. Let me split it in two, because the answers are quite different.

Restoring backups without server access already works today. Restores run entirely through the web UI. A user picks the backup file in the storage explorer, chooses the target, and DBackup handles the download, decryption, decompression and the actual restore, with a preflight check and live progress. No mounting, no copying files around by hand. That part of your problem is solved.

Restricting that access to specific resources is not possible yet. The RBAC system works at the role level only. A group either has the "restore backups" permission or it does not, and if it does, it applies to every backup in the system. The same goes for sources, jobs and destinations. There is currently no way to say "this user only sees these databases".

DBackup is also not multi-tenant, and I want to be upfront that it will not become multi-tenant. It was not designed for it, and retrofitting real tenant isolation with separate users, audit logs, settings and encryption keys per customer would be a rewrite rather than a feature.

Resource-scoped permissions are a different matter. Binding a group to a set of sources or destinations and filtering everything a user sees by that is a substantial feature, but a realistic one, and it would cover what you describe. I would like to look into it properly.

One honest caveat on the restore side, since that is the harder half. Backups on a destination are plain files with a small .meta.json sidecar next to them. That is deliberate, so you are never locked into DBackup to read your own archives. The sidecar does record which job and source produced the file, so backups can be attributed. But it lives in your bucket rather than in DBackup's database, so it cannot be the thing that grants access on its own, and files that were placed there by hand or lost their sidecar have no reliable owner at all. The way I would solve it is default-deny: a scoped user only sees backups that map to something they are assigned, and anything unattributable stays admin-only. Scoping at the destination level instead of per file is also an option and a much smaller change, which might suit you well if each customer already has their own bucket or path prefix.

Until something like that exists, the only way to get real separation is a separate DBackup instance per customer. I assume that is not attractive for a handful of clients and resellers, but I wanted to mention it.

To scope this properly, two questions:

1. What should your clients actually be able to do? Only browse and restore their own backups, or also create and edit jobs, add sources and change schedules?
2. Is filtered visibility enough, meaning everyone on one instance but each client only sees their own resources, or do you need full separation including their own user management and audit trail?

If it is the first in both cases, that is very doable. I am currently finishing the Docker volume backup implementation and had the DBackup agent planned next, but I am happy to look at this in parallel.

Thanks again for the input, this kind of feedback is exactly what helps me decide what to build next.

[kayvanaarssen]

Depends on the client. If its a reseller can be the Whole server and thus also allow to create jobs etc.
But some resellers only allowed to restore backups/download/run jobs.

And some only have access to specific backups on a shared server. We are in the MSP world so its different than when you use this for a project or in a company/homelab. So like i've mentioned in the other issue. I'm open for a quick meet so we can discuss and then report back in the correct issues. Just to be aligned on the things and you know what's really out there.