~*~ SqlVault2 — Rust
# Recoverability
is the contract.
SqlVault2 is a recoverability-first SQL Server backup system written in Rust. It encrypts databases with streaming AES-256-GCM, uploads to cloud storage, and automatically proves every backup is restorable. Clean-host recovery, fail-closed audit, and crash reconciliation — built for when restore actually matters.
~*~ The Problem
# A backup you cannot restore after host loss is a liability.
Most backup systems verify the upload, not the restore. When the original host dies and the local metadata is gone, recovery becomes a manual archaeology project. The rewrite makes restoreability the primary acceptance criterion — not a claim, but a gate the system passes before certifying any run.
Every full backup is automatically restore-drilled. The release gate requires a lost-host restore drill: produce an artifact, destroy the host and catalog, then restore using only the cloud artifact, recovery key, and released binaries.
~*~ What You Get
# Features
Automatic Restore Drills
Every successful full backup is queued for a background restore drill — restored to a scratch database, DBCC CHECKDB-verified, dropped, and certified. Restoreability is proven, not promised.
Streaming AES-256-GCM
Databases are encrypted in-flight with streaming AES-256-GCM. No plaintext ever touches disk. Versioned artifact containers handle compatibility across releases.
Clean-Host Restore
Restore on a machine with no prior SQLite catalog using only the cloud artifact and a documented recovery key. The release gate requires this drill to pass before any version ships.
Crash Reconciliation
Durable queue with lease-based workers. On restart, the engine classifies every in-flight job as restartable, resumable, or terminal. No silent partial successes, no orphaned state.
KEK Ring + Recovery Keys
AES-KW key wrapping around a KEK ring. Passphrase-protected recovery key export/import means a lost host does not mean lost backups.
Fail-Closed Audit
HMAC-chained audit log requires an explicit key. If the key is missing, the server refuses to start. No silent operation, no tampered history.
File Backup + Dedup
FastCDC content-defined chunking with per-chunk AES-256-GCM, SHA-256 deduplication, glob exclusions, and delta sync manifests. Efficient incremental file protection.
Loopback-Only Admin
Web UI and API bind to 127.0.0.1 only — enforced, not configurable. CSRF tokens, Origin checks, CSP, Secure/HttpOnly/SameSite=Strict cookies, and rate limiting.
~*~ How It Works
# The Pipeline
Each step is a gate. Crash reconciliation classifies interrupted jobs as restartable, resumable, or terminal. No silent partial successes.
~*~ Architecture
# Eight Crates, No Cloud Server
Spec-driven: every module has a SPEC.md with acceptance criteria. The traceability matrix maps requirements to specs to tasks to tests.
~*~ Subscription
# Plans
Subscription-based, scaled by number of sites and feature tier. Email for a quote tailored to your deployment.
Single Site
One SQL Server installation
- Full / differential / log backups
- Streaming AES-256-GCM encryption
- Automatic restore drills on every full backup
- Google Drive or local storage
- Loopback-only web UI
>> Most common
Multi-Site
MSP / IT provider managing several sites
- Everything in Single Site
- Per-site configuration and retention policies
- Clean-host restore for disaster recovery
- Recovery key export/import workflow
- SMTP + webhook alerting (admin + customer)
Enterprise
Custom requirements & SLAs
- Everything in Multi-Site
- File backup with FastCDC deduplication
- HMAC-chained audit log (fail-closed)
- Custom retention and compliance policies
- Direct support and onboarding
~*~ FAQ
# Questions
What makes this different from the original SqlVault?
SqlVault2 is a ground-up rewrite in Rust with a spec-driven development process. The north star is verified restoreability — including recovery after the original host and local SQLite metadata are unavailable. Every full backup is automatically restore-drilled, and the release gate requires a lost-host restore drill to pass.
What happens if the server crashes mid-backup?
The engine uses a durable queue with lease-based workers. On restart, crash reconciliation classifies every in-flight job as restartable, resumable, or terminal. No silent partial successes, no orphaned state.
Can I restore on a completely new machine?
Yes. The restore-clean-host CLI subcommand recovers a database on a machine with no prior SQLite catalog, using only the cloud artifact and a documented recovery key. This is tested in every release gate.
How is the audit log secured?
The audit log is HMAC-chained and fails closed without an explicit key. If the key is missing from the config, the server refuses to start. No silent operation, no tampered history.
Does it support file backup too?
Yes. File backup uses FastCDC content-defined chunking with per-chunk AES-256-GCM encryption, SHA-256 deduplication, glob exclusion rules, and delta sync manifests for efficient incremental protection.
How is pricing structured?
Subscription-based, scaled by number of sites and feature tier. Email for a quote tailored to your deployment.
~*~ Get In Touch
Want more information?
Email for pricing, deployment details, or a walkthrough. I read every enquiry and will get back to you with a quote tailored to your setup.