Deployment

Backup and restore

Save and restore the databases, the stored files and the secrets of a server with the scansuite command.

What a server holds is in three places: the databases of ScanSuite and DefectDojo, the files the scans stored, and the secrets of the installation — .env and the key/ folder with the licence and the encryption keys. The ./scansuite command in /opt/scansuite saves and restores all three:

Command	What it does
./scansuite --backup-db [zip]	Saves the ScanSuite and DefectDojo databases into one zip.
./scansuite --restore-db <zip>	Replaces the databases with the ones in a backup.
./scansuite --backup-secrets [zip]	Saves .env and key/ into a password-protected zip.
./scansuite --restore-secrets <zip>	Puts .env and key/ back. Asks for the password.

The same commands can be written ./scansuite backup db, restore db, backup secrets and restore secrets.

A backup is one zip, written to /opt/scansuite/backups/, named after the date and time and readable only by its owner. To write it elsewhere, name a file or a directory after the command. An existing file is never replaced.

Copy the backups off the server. A backup that exists only on the disk it protects is lost together with it.

Back up the databases

Shell

cd /opt/scansuite && ./scansuite --backup-db

Both databases are saved while ScanSuite keeps running, and the command prints where the zip is. Three options change what goes into it:

Option	What it does
--with-files	Adds the files the databases point to: scan reports and other scan artifacts, and DefectDojo uploads. The file storage is stopped while they are copied, and the zip needs as much free space as the files take.
--encrypt	Protects the zip with a generated password, as the secrets backup is. The password is printed once.
--no-dojo	Leaves the DefectDojo database out.

Without --with-files a restore brings back every scan and finding, but not the report files that were stored with them.

A cron job for a nightly backup to a mounted disk (edit with sudo crontab -e):

crontab

0 2 * * * cd /opt/scansuite && ./scansuite --backup-db /mnt/backup > /var/log/scansuite-backup.log 2>&1

Restore the databases

Shell

cd /opt/scansuite && ./scansuite --restore-db backups/scansuite-teams-db-20261011-132415.zip

The command reads the whole zip before it changes anything, then:

refuses a backup it cannot restore here: one from another edition, one made by a newer release (update first), or one from a newer PostgreSQL;
says what will be replaced and asks for confirmation, unless --yes is given;
saves the databases as they are now to backups/before-restore-<date>.zip, unless --no-safety-backup is given;
stops ScanSuite, replaces each database, and puts back the stored files when the backup has them;
brings a backup made by an earlier release up to the current release, and starts ScanSuite and DefectDojo again.

ScanSuite is unavailable for a few minutes while this runs. If a step fails, the message names the before-restore zip and the command that puts it back.

A restore replaces the databases. Scans, findings, accounts and settings stored after the backup was made are lost.

Back up the secrets

Shell

cd /opt/scansuite && ./scansuite --backup-secrets

The zip holds .env and everything in key/: the licence file and scansuite-secrets.env with the keys that encrypt stored integration, single sign-on and AI credentials. It opens only with a password that is generated for it:

Output

[+] Secrets saved to /opt/scansuite/backups/scansuite-teams-secrets-20261011-132509.zip
[!] The file opens only with this password. It is shown once and stored nowhere:

    <32 characters>

[*] Keep it apart from the file.

Write the password down when it is shown: it is not saved on the server and cannot be shown again. Make a new secrets backup whenever .env or the licence changes.

A database backup is complete only together with a secrets backup of the same installation. Restored with other encryption keys, the stored credentials cannot be decrypted.

Restore the secrets

Shell

cd /opt/scansuite && ./scansuite --restore-secrets backups/scansuite-teams-secrets-20261011-132509.zip

The command asks for the password and checks it before it changes anything. It then keeps the present .env and key/ in .replaced-<date>/, puts the saved files back with their owners and permissions, and restarts the services so they take the restored settings; --no-restart leaves that to you.

Where nobody is there to type the password, a restore reads it from the SCANSUITE_BACKUP_PASSWORD environment variable. The same applies to a database backup made with --encrypt.

Move to a new server

01
Back up the old server
Save the databases with the stored files, and the secrets. Copy both zips to the new server and note the passwords.
Shell
```
./scansuite --backup-db --with-files && ./scansuite --backup-secrets
```
02
Install ScanSuite on the new server
A normal installation with your licence.
03
Restore the secrets
First, so that the databases are restored under the keys they were encrypted with.
Shell
```
cd /opt/scansuite && ./scansuite --restore-secrets <zip>
```
04
Restore the databases
Shell
```
./scansuite --restore-db <zip>
```

The installation steps are in Install ScanSuite Teams.

How the zips are protected

The password protection is the standard one of the zip format, so any zip program opens the file with the password. It keeps the file from being read in passing; it is weaker than modern encryption, so store a protected zip as carefully as any other secret.

An installation on Google Cloud or Microsoft Azure keeps its data in managed services with backups of their own: see Install on Google Cloud and Install on Microsoft Azure.

Last reviewed 2026-10-11