Set up automated MariaDB Galera cluster backups with compression

Install Mariabackup

Mariabackup ships as part of the MariaDB backup package. Install it on the node you plan to run backups from, ideally a non-primary node to avoid extra load on the write path.

sudo apt update
sudo apt install -y mariadb-backup gzip zstd

sudo dnf install -y MariaDB-backup gzip zstd

Create a dedicated backup user

Avoid using the root MariaDB account in scripts. Create a user scoped to only the privileges Mariabackup needs.

sudo mysql -u root -p

CREATE USER 'backupuser'@'localhost' IDENTIFIED BY 'Kx9#mPz2Trq!Lw7v';
GRANT RELOAD, LOCK TABLES, PROCESS, REPLICATION CLIENT, BACKUP_ADMIN ON *.* TO 'backupuser'@'localhost';
FLUSH PRIVILEGES;
EXIT;

Store credentials securely

Create a MariaDB option file readable only by the backup script's user, instead of embedding the password in the script or command history.

sudo mkdir -p /etc/mysql/backup
sudo tee /etc/mysql/backup/.mycnf > /dev/null <<'EOF'
[client]
user=backupuser
password=Kx9#mPz2Trq!Lw7v
EOF
sudo chown root:root /etc/mysql/backup/.mycnf
sudo chmod 600 /etc/mysql/backup/.mycnf

Setting permissions to 600 means only the file owner, root in this case, can read or write it. This prevents other local users from reading the database password.

Create the backup directory structure

Separate raw backups from compressed archives, and keep a dedicated log directory.

sudo mkdir -p /var/backups/mariadb/{staging,archives,logs}
sudo chown -R mysql:mysql /var/backups/mariadb
sudo chmod 750 /var/backups/mariadb
sudo chmod 750 /var/backups/mariadb/staging /var/backups/mariadb/archives /var/backups/mariadb/logs

The mysql system user needs to read and write here since Mariabackup runs under that account during the backup. 750 permissions allow the owner full access and the group read/execute, while blocking all other users.

Write the backup script with compression and rotation

This script takes a full Mariabackup snapshot, streams it through zstd for fast compression, timestamps the archive, and deletes archives older than the retention window.

#!/bin/bash
set -euo pipefail

BACKUP_USER_CNF="/etc/mysql/backup/.mycnf"
STAGING_DIR="/var/backups/mariadb/staging"
ARCHIVE_DIR="/var/backups/mariadb/archives"
LOG_DIR="/var/backups/mariadb/logs"
RETENTION_DAYS=7
TIMESTAMP=$(date +%Y%m%d-%H%M%S)
BACKUP_NAME="galera-backup-${TIMESTAMP}"
LOG_FILE="${LOG_DIR}/${BACKUP_NAME}.log"

mkdir -p "${STAGING_DIR}/${BACKUP_NAME}"

echo "[$(date)] Starting Mariabackup for ${BACKUP_NAME}" >> "${LOG_FILE}"

mariabackup --defaults-extra-file="${BACKUP_USER_CNF}" \
  --backup \
  --target-dir="${STAGING_DIR}/${BACKUP_NAME}" \
  >> "${LOG_FILE}" 2>&1

mariabackup --defaults-extra-file="${BACKUP_USER_CNF}" \
  --prepare \
  --target-dir="${STAGING_DIR}/${BACKUP_NAME}" \
  >> "${LOG_FILE}" 2>&1

echo "[$(date)] Compressing backup with zstd" >> "${LOG_FILE}"
tar -cf - -C "${STAGING_DIR}" "${BACKUP_NAME}" | zstd -T0 -19 -o "${ARCHIVE_DIR}/${BACKUP_NAME}.tar.zst"

rm -rf "${STAGING_DIR}/${BACKUP_NAME}"

echo "[$(date)] Rotating archives older than ${RETENTION_DAYS} days" >> "${LOG_FILE}"
find "${ARCHIVE_DIR}" -name "galera-backup-*.tar.zst" -mtime +${RETENTION_DAYS} -delete
find "${LOG_DIR}" -name "galera-backup-*.log" -mtime +${RETENTION_DAYS} -delete

echo "[$(date)] Backup ${BACKUP_NAME} completed successfully" >> "${LOG_FILE}"

zstd at level 19 with multi-threading (-T0) gives strong compression without the long runtimes of gzip -9 on multi-gigabyte datasets. If you prefer gzip for compatibility with older tooling, replace the compression line with tar -czf "${ARCHIVE_DIR}/${BACKUP_NAME}.tar.gz" -C "${STAGING_DIR}" "${BACKUP_NAME}".

Set correct ownership and permissions on the script

The script needs to run as the mysql user since that account owns the data directory and staging path. It should not be world-writable.

sudo chown root:mysql /usr/local/bin/galera-backup.sh
sudo chmod 750 /usr/local/bin/galera-backup.sh

Test the script manually

Run it once by hand before automating it, so you can confirm output and catch permission errors early.

sudo -u mysql /usr/local/bin/galera-backup.sh
ls -lh /var/backups/mariadb/archives

Create the systemd service unit

This defines what runs, and as which user.

[Unit]
Description=Galera cluster backup with Mariabackup
After=mariadb.service
Requires=mariadb.service

[Service]
Type=oneshot
User=mysql
Group=mysql
ExecStart=/usr/local/bin/galera-backup.sh
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=7

Nice and IOSchedulingClass keep the backup from starving the mysqld process of CPU and disk I/O during peak hours.

Create the systemd timer unit

This schedules the service to run nightly at 02:15, with a randomized delay to avoid every cluster node hitting disk I/O at the exact same second.

[Unit]
Description=Run Galera backup nightly

[Timer]
OnCalendar=*-*-* 02:15:00
RandomizedDelaySec=600
Persistent=true

[Install]
WantedBy=timers.target

Enable and start the timer

sudo systemctl daemon-reload
sudo systemctl enable --now galera-backup.timer
systemctl list-timers galera-backup.timer

Stagger schedules across cluster nodes

Running full backups on every node simultaneously wastes disk I/O and network bandwidth for no benefit, since the data is identical. Pick one designated backup node per cluster, and only enable the timer there. Keep the package installed on other nodes as a manual fallback.

sudo systemctl disable --now galera-backup.timer

Run this on the nodes that should not perform scheduled backups. If your designated backup node goes down, you can enable the timer on a secondary node temporarily.

Verify archive integrity

Confirm the compressed archive is not truncated or corrupted before you rely on it.

zstd -t /var/backups/mariadb/archives/galera-backup-20250601-021500.tar.zst
echo $?

An exit code of 0 means the archive passed integrity checks. Any other value means the file is corrupted and you should investigate the backup job's logs.

Extract and prepare for restore

Decompress into a scratch location, separate from the live data directory.

mkdir -p /tmp/restore-test
zstd -d /var/backups/mariadb/archives/galera-backup-20250601-021500.tar.zst -o /tmp/restore-test/backup.tar
tar -xf /tmp/restore-test/backup.tar -C /tmp/restore-test

Restore a failed or new node

Stop MariaDB, clear the existing data directory and copy the prepared backup into place. Do this only on a node you are rebuilding, never on a healthy node still serving traffic.

sudo systemctl stop mariadb
sudo mv /var/lib/mysql /var/lib/mysql.bak
sudo mkdir /var/lib/mysql
sudo mariabackup --copy-back --target-dir=/tmp/restore-test/galera-backup-20250601-021500
sudo chown -R mysql:mysql /var/lib/mysql
sudo chmod 750 /var/lib/mysql

Start the restored node and rejoin the cluster

Start MariaDB and confirm it rejoins via SST or reports a healthy wsrep state.

sudo systemctl start mariadb
sudo mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_cluster_size';"
sudo mysql -u root -p -e "SHOW STATUS LIKE 'wsrep_local_state_comment';"

You want wsrep_local_state_comment to report Synced. For full cluster setup details, see Configure MariaDB Galera cluster 10.11 for multi-master replication.

Install the S3-compatible client

sudo apt install -y awscli

Configure remote credentials

Store credentials in a restricted profile file, not inline in scripts.

sudo -u mysql aws configure --profile galera-backup

Provide your access key, secret key, and region when prompted. This writes to ~mysql/.aws/credentials, which should already inherit restrictive permissions from the mysql home directory.

Add the upload step to the backup script

Append this block to the end of the backup script, after the rotation step.

echo "[$(date)] Uploading archive to remote storage" >> "${LOG_FILE}"
aws s3 cp "${ARCHIVE_DIR}/${BACKUP_NAME}.tar.zst" \
  s3://example-galera-backups/nightly/ \
  --profile galera-backup \
  --endpoint-url https://s3.eu-central-1.example.com \
  >> "${LOG_FILE}" 2>&1
echo "[$(date)] Remote upload complete" >> "${LOG_FILE}"

Point --endpoint-url at your actual S3-compatible provider. For a self-hosted alternative, see Setup S3-compatible disaster recovery with cross-region replication using MinIO.

Encrypt archives before upload for sensitive workloads

If your data falls under GDPR or contains customer PII, encrypt the archive before it leaves the host, rather than relying solely on transport encryption.

gpg --batch --yes --passphrase-file /etc/mysql/backup/.gpgpass \
  --cipher-algo AES256 \
  --symmetric \
  --output "${ARCHIVE_DIR}/${BACKUP_NAME}.tar.zst.gpg" \
  "${ARCHIVE_DIR}/${BACKUP_NAME}.tar.zst"

For a full walkthrough of key rotation and secure passphrase handling, see Implement MariaDB backup encryption with Mariabackup and automated restoration.