Skip to content
Back to

Backup and restore

Fontana gives you two complementary recovery paths: platform snapshots for host-level upgrade rollback, and application configuration backup in Flow for migrating or restoring workspace settings. Together they cover release safety, operator change control, and configuration portability without mixing secrets into export files.

Platform snapshots and rollback

Section titled “Platform snapshots and rollback”

Before a workspace upgrade, the host takes an automatic full-stack snapshot: the pinned release metadata plus the workspace data volume. That gives you a reversible change-control point when applying a new Fontana version.

CapabilityWhat it does for you
Pre-upgrade snapshotCaptured automatically when the bundle release changes during upgrade
Manual snapshotOperators can create a snapshot on demand before risky changes
RollbackRestores the data volume and redeploys the pinned release from the chosen snapshot
RetentionConfigurable how many snapshots to keep per workspace on the host

Rollback is an operator action on the host via the Fontana CLI (fontana rollback). It is the primary path when an upgrade must be undone quickly while keeping workspace data intact.

Application configuration backup (Admin)

Section titled “Application configuration backup (Admin)”

In Flow, Admin → Deployment → Backup/Restore exports and imports a composite configuration backup for your workspace. Use it to clone settings across environments, recover after a configuration mistake, or document approved platform state.

Export includes (non-secret application configuration):

  • Roles, teams, and users (users merge by email on restore)
  • Workflows and workflow documents
  • AI agents, skills, skill assignments, and approved model lists
  • MCP and external agent interop connections (connection definitions in the backup file)
  • Knowledge Graph sources and documents
  • Non-secret platform configuration keys

Export does not include:

  • BYOK and other Vault secrets - LLM keys and sensitive credentials stay in Vault; restore them through your secret-management procedures
  • Workflow run datasets - tabular run data and exports live in workspace storage (see Storage and processing); use platform snapshots or your DR policy for volume-level recovery

Restore shows a preview with per-section choices: skip duplicates, overwrite, or import as duplicate. You control which sections apply before committing.

Requires platform:write permission (typically administrators).

When to use which path

Section titled “When to use which path”
ScenarioRecommended path
Undo a failed platform upgradePlatform snapshot rollback via Fontana CLI
Migrate workflows and AI config to another workspaceAdmin Backup/Restore composite export/import
Recover secrets and BYOKVault backup procedures (operator runbook); composite export excludes secrets by design
Recover workflow run history and uploadsPlatform snapshot rollback or volume-level DR per your host policy
Change control before a host maintenance windowManual platform snapshot + optional Admin export

Upgrades and change control

Section titled “Upgrades and change control”

Production deploys use immutable release tags so every upgrade is reproducible and auditable. The automatic pre-upgrade snapshot is part of that story: you can always roll back to the prior release and data state if validation fails after apply.

For day-to-day reconciliation on the host, see Fontana CLI (fontana apply, fontana tenant upgrade, snapshot commands).

Section titled “Related documentation”