Backup and Restore

This page is also in the Courier wiki: https://github.com/rsjsoftwareltd/courier/wiki/Backup-and-Restore

Everything Courier keeps is in one folder, apart from the program files, so an upgrade or an uninstall does not remove it. Courier also backs its database up for itself every night, and can make a password-protected file of its settings.

What Courier keeps #

C:\ProgramData\RSJ Software\Courier\Data, not the program folder (C:\Program Files\RSJ Software\Courier). It holds:

courier.db -- the database: accounts, notices, delivery records and receipts, templates, the enrolled computers and your settings.
certs -- the certificate Courier made for HTTPS, and its key.
branding -- your school's logo, if you added one.
backups -- the nightly database backups (below).
logs -- the service's log. Useful when asking for help (General Settings -> Logs shows it and can collect a support .zip); not needed to restore.
updates -- an installer downloaded by Update now, kept only until it is used.

Some things in the database are encrypted for this server's Windows identity: the connection secret, the Active Directory account's password, the update token and each account's two-factor secret. Only the service on the same Windows installation can read them.

Courier backs the database up for itself #

Every night at 02:30, Courier takes a copy of the database, checks that the copy is readable before keeping it, and keeps the newest seven. General Settings -> Backup -> Database backup shows where they go and what is there, with a Back up now button if you would rather not wait for tonight, and a box to choose another folder.

By default the backups are in Data\backups, on the same drive as the database, so they do not survive that drive failing. Type a folder on another drive or a network share in Backup folder (a full path; the Courier service, which runs as Local Service, must be allowed to write there). A backup holds everything in the database, so only administrators and the Courier service should be able to read that folder. The page says so when the folder is on the same drive as the database.

Restoring from a nightly backup #

Open General Settings -> Backup, find the backup in the list and press Restore....
Read what will be lost: everything recorded after that backup was taken. Type RESTORE and press Prepare restore. Nothing changes yet; Courier has checked the backup and set a copy beside the live database.
Restart the Courier service in Services (or restart the server), within 60 minutes. Courier does not restart itself. The restore is applied as the service starts, before anything uses the database. A restore that was not applied within the hour is abandoned, so it cannot surprise anyone on a later restart; the page says so.

The database that was replaced is kept beside the new one as courier.pre-restore-<date and time>.db (the newest one only), so a mistaken restore can be undone by hand: stop the service, put that file back as courier.db, delete courier.db-wal and courier.db-shm, start the service. Cancel the restore on the same page throws a prepared restore away.

If the backup came from another server, the secrets in it (the connection secret, the update token, the directory account's password, the two-factor secrets) cannot be opened by this one. The page says which; enter them again, or restore a settings backup file (next section) as well.

The settings backup file #

General Settings -> Backup -> Backup and restore (press Download backup) makes a file, protected by a password you choose (at least 10 characters; Courier cannot recover it), that holds this server's accounts, audiences, templates, school name and settings, the connection secret, the update token, the directory account, the server's certificate and each account's two-factor sign-in (so restoring it does not turn anyone's off). Keep the file and the password somewhere other than the server. It does not hold the message history; the nightly database backup does. The logo is not in it: upload it again.

To use it, choose the file on the same page, type its password and press Restore. The accounts, audiences, templates and settings are replaced by the ones in the file, everyone is signed out, and the certificate is put back (restart the service to use it; the computers recognise the certificate, so they keep working). Moving to a new server is: install Courier there, restore a settings backup file, then restore a nightly backup if you want the history. Moving a server has not been tried on a school's computers; expect to check that they check in.

Copying the folder by hand #

You can still copy the folder yourself, and it is worth doing before an upgrade, as Getting Started says.

Stop the Courier service (Courier -> Stop Service in the Start menu, or Services), so the copy is whole.
Copy the whole Data folder to a safe place, ideally off the server.
Start the service again.

To restore a copy: stop the service, put the copied Data folder back in place of the damaged one, start the service and sign in.

What a restore does not do #

It brings back the history as it was at the time of the backup. A notice sent after that is not in it.

If every administrator account is lost #

Run Courier.exe --setup-admin from an elevated prompt in the program folder. It is for recovery only, and refuses to replace an account that exists. See Getting Started.