Protect data and verify recovery

Overview

Persistence introduces operational responsibilities: schema management, protected key material, backups and retention. A restored database without the matching protection keys can leave connection grants unreadable. Evidence, monitoring and application records have different retention needs.

Encrypted records depend on their key material

A backup may contain encrypted connection grants without the keys needed to decrypt them. Restoring that database onto a new Host therefore requires the corresponding data-protection/key configuration as well as schema compatibility. Do not wait until an incident to discover that a valid database backup cannot restore a user's connections.

Retention differs by data type

Application records, conversation state, monitor captures, signed evidence and knowledge indexes serve different purposes and may use different stores. Choose retention and restore procedures for each. A restore can also reintroduce old operation records, so reconcile external effects before resuming automation from recovered state.

Restore data with its protection keys

1. Use the SQL data-protection key ring and a host-configured protection certificate where required; keep private keys in an appropriate secret/certificate system.
2. Back up application data and protection material with a tested recovery procedure. Apply schema changes through the supported initialization/migration path.
3. Restart the sample and check agent state, history, harness snapshots, reminders and delivery checkpoints. Record in-flight tasks that could not resume.

using FabrCore.Host;
using FabrCore.Services.Connections;
using FabrCore.Services.RemoteAgents;

builder.AddFabrCoreServer(new FabrCoreServerOptions {
    AdditionalAssemblies = [typeof(ConnectionsExtensions).Assembly,
                            typeof(RemoteAgent).Assembly]
});
builder.Services.AddFabrCoreConnections(o => {
    o.Enabled = true;
    o.EntraAgentIdEnabled = false;
    o.ClientHandoffEnabled = false;
});
builder.Services.AddFabrCoreRemoteAgents(o => o.Enabled = true);

// Also configure the host's normal user authentication/authorization.
var app = builder.Build();
app.UseFabrCoreServer();
app.MapFabrCoreConnections();
app.Run();

{
  "FabrCore": {
    "DataProtection": {
      "ApplicationName": "my-cluster-production",
      "CertificatePath": "/run/secrets/fabrcore-protection.pfx"
    }
  }
}

Go deeper

Explore the related documentation.

• FabrCore Database Modes
• FabrCore Access Control
• FabrCore Server
• Host setup