Add database backup and restore

README.md

@@ -70,6 +70,32 @@ The command works on Windows, Linux, and macOS. It prints `SMTP_TEST_SENT_TO=<ad
 
 SMTP connection and delivery have been verified for the current deployment environment.
 
+## Automated database backups
+
+The portable backup tool creates a consistent snapshot from the running Docker service using SQLite's backup API. It retains the most recent 30 days by default; snapshots are stored in the ignored `backups/` directory.
+
+```sh
+python ./scripts/backup-database.py
+python ./scripts/verify-backup.py ./backups/eternity-YYYYMMDDTHHMMSSZ.db
+```
+
+The restore verification copies the selected snapshot to a temporary location, checks SQLite integrity, and reports the recovered user and post counts. It never changes the live database.
+
+Schedule a daily backup from the project directory. Ensure the scheduler environment provides `SECRET_KEY` for Docker Compose interpolation, or use the same `.env` file used to start the service.
+
+```cron
+0 2 * * * cd /srv/docker-ep-blog-web-server && SECRET_KEY="$(grep '^SECRET_KEY=' .env | cut -d= -f2-)" python3 ./scripts/backup-database.py >> backups/backup.log 2>&1
+```
+
+On Windows, create a daily Task Scheduler task with **Start in** set to the project directory and this program/argument pair:
+
+```text
+Program: python.exe
+Arguments: .\scripts\backup-database.py
+```
+
+Run `python ./scripts/verify-backup.py <backup-file>` after the first scheduled backup and at least quarterly. Keep an encrypted copy of `backups/` outside the Docker host.
+
 ## Production notes
 
 Put this service behind a TLS reverse proxy for `eternityproject.fi` (for example Caddy or Nginx). Set a strong unique `SECRET_KEY`; the Compose file intentionally refuses to start without it. Back up the `eternity_data` Docker volume, which contains accounts and posts.