Database operations / Independent product
A backup plan across the computers you own.
LAN-first MySQL and MariaDB backups, with scheduled copies sent to paired computers and a local dashboard to keep track of them.
- Product
- Sevjala
- Platform
- Windows · macOS · Linux
- Built with
- Go, mutual TLS, SQLite, Svelte 5, Windows service
- Made at
- Sevtee, as an independent product
A controller creates and verifies dumps, then sends them to paired backup nodes over mutual TLS. Retention policies manage the copies, and restores use a new database by default.
What it does
Sevjala backs up MySQL and MariaDB databases across the computers a small office already owns, with no cloud. It began with the XAMPP installations I kept meeting in shops and schools that had no database administrator and no backup beyond hope.
One Go binary runs everywhere. A Controller on the database PC dumps, verifies and pushes backups over mutual TLS to paired backup PCs on the local network, called Nodes. It is operated from the command line, from a tray icon with a green, yellow or red verdict, and from a local browser dashboard. It targets Windows 7 and later, macOS and Linux.
What was built
- Discovery by UDP broadcast with a manual address fallback, and pairing with a six-digit code that proves both certificate fingerprints with an HMAC before anything else happens.
- Mutual TLS with self-signed certificates and pinned fingerprints. No certificate authority to run.
- A streaming dump pipeline: mysqldump to gzip to file, hashed with SHA-256 in one pass, written to a temp file and renamed atomically, with a manifest beside it. Nodes verify the hash while they write.
- Schedules in cron syntax with catch-up after downtime, per-node retention, and a reconciliation loop every five minutes.
- Restore into a new database by default. Replacing production requires typing the database name and takes a pre-restore backup first.
- Service install on all three platforms, Windows firewall rules, a double-click setup wizard, self-update checked against release checksums, and the database password kept in the OS keyring.
- A Svelte 5 dashboard embedded in the binary, served on demand on localhost only.
- Managers: a backup PC that can drive the Controller through a connection the Controller itself opens.
Engineering decisions
- The Controller is the only side that ever dials; Nodes are passive servers. Even the manager feature reuses a Controller-opened connection, so nothing new listens on the database PC and Nodes never need its address.
- UDP broadcast instead of mDNS, because Windows 7 has no mDNS and multicast misbehaves on cheap switches.
- The Controller’s store is authoritative for what should exist, each Node’s folder listing for what does. The difference drives reconciliation, and Nodes need no database.
- Retention never deletes a database’s last verified backup, ignores deletions while any backup is dated in the future (a clock moved back), and treats an unreadable Node store as unknown rather than empty.
- Restore reads the file twice, once to verify size and hash and once to load. A deliberate exception to the single-pass rule, because a damaged backup must never be half-loaded.
What I learned
Windows 7 is still out there, and reaching it meant building with a patched Go toolchain pinned by checksum, and learning Windows service installation, named-pipe permissions, UAC self-elevation and firewall rules, all in pure Go.
The security design showed me how far you can get without a certificate authority: pin fingerprints first, then bootstrap trust with a short code that burns after five attempts or ten minutes. I also learned that a backup tool’s hardest rules are about not deleting. Most of the retention decisions exist because a flaky Node or a wrong clock must never cost the last good copy.
The smoke tests found a fault no unit test would: a VPN client on one machine dropped packets over roughly 250 bytes, which failed the TLS handshake and made a Node look offline.