A step-by-step guide to configuring pgBackRest's native TLS transport mode for PostgreSQL disaster recovery, as an alternative to SSH-based setups. Covers the security rationale (eliminating lateral movement risk, certificate-based access control), building a CA and issuing server/client certificates with OpenSSL, configuring the TLS server daemon on the Backup Node, setting up the DR server, performing full and point-in-time restores, and critical post-restore steps like disabling archive_mode. Also discusses pgBackRest's lack of CRL support and when TLS mode is preferable to SSH at scale.
Table of contents
SSH Gets the Job Done Securely. TLS Can Help at Scale.Security Isolation and Lateral MovementHow does pgBackRest TLS Mode Work?Step 1: Get the DR Server ReadyStep 2: Build the Certificate InfrastructureStep 3: Configure the TLS Server on the Backup NodeStep 4: Configure pgBackRest on the DR ServerStep 5: Verify the ConnectionStep 6: RestoreStep 7: Disable Archiving Before Starting PostgreSQLStep 8: Start and Validate359 Impressions