MB Horizon Disaster Recovery

Recovery Controller Ready

Controller

Online

Recovery Mode

Enabled

Destructive Restore

Disabled until restore phase

Emergency Recovery Bundle

Upload the encrypted .tar.gpg Emergency Bundle saved outside the MB-Panel servers. The decrypted secrets are never kept as an extracted archive.

Emergency Recovery Bundle Bundle Encryption Password

Import only restores and validates recovery credentials. Bundle v2 also contains dedicated takeover credentials. Upgrading an existing Bundle v1 recovery does not rerun Full DR or PITR and does not by itself enable Writer Promotion.

Backup Discovery

Discover Full DR and PITR recovery points from all imported Restic repositories. Discovery uses read-only SFTP and restic --no-lock.

Selecting a Recovery Point does not start a restore. Destructive restore remains disabled.

Recovery Point Selection

Select a fully replicated Full DR run. The server independently re-discovers all three repositories before accepting the selection.

No Recovery Point selected.

Full DR restore and PITR replay are still disabled.

Full DR Restore Preparation

Verify the selected Full DR payload on all three repositories, validate its manifest and build a non-destructive Restore Plan.

Full DR Restore has not been prepared.

Preparation only. Restore authorization remains disabled.

Isolated Full DR Payload Staging

Download the verified Full DR payload into an isolated Recovery-only staging directory.

Full DR payload has not been staged.

Local staging only. Application, MySQL and PITR restore remain disabled.

Automatic Full DR Recovery Execution

This is the first destructive Recovery step. It automatically installs the required runtime, restores source/environment/storage, imports MySQL, builds MB-Panel, starts it with background workers disabled, and validates the application locally.

After Full DR validation, PITR is queued automatically. Production Nginx/SSL cutover and backup-writer promotion remain disabled.

Type RESTORE exactly to authorize Full DR recovery

Destructive Full DR recovery has not started.

Automatic PITR Replay

Replay the latest fully replicated closed MySQL binlogs from all three backup repositories. The first binlog starts exactly at the Full DR recovery position; later binlogs are replayed from the start.

PITR waits until Full DR restore is complete.

Backup-writer promotion and Production cutover remain disabled.