{% extends "base.html" %}
{% block content %}
<section class="page-heading"><div><span class="eyebrow">Installation recovery</span><h1>Backup and recovery</h1><p>Download an encrypted copy of this installation and restore it on a fresh host.</p></div></section>
<section class="card">
  <h2>Create an encrypted backup</h2>
  <p>The archive contains the database, CA and certificate keys, users and MFA credentials, settings, complete audit history, HTTPS identity and locally managed SoftHSM tokens.</p>
  <p class="notice">Keep the archive and its passphrase separately. Anyone who has both can recover your CA keys and credentials. Lost backup passphrases cannot be reset.</p>
  <form method="post" action="{{ url_for('backup.export') }}">
    <input type="hidden" name="csrf_token" value="{{ csrf_token() }}">
    <label>Backup passphrase <input type="password" name="passphrase" minlength="20" maxlength="256" autocomplete="new-password" required></label>
    <label>Confirm backup passphrase <input type="password" name="passphrase_confirm" minlength="20" maxlength="256" autocomplete="new-password" required></label>
    <p class="form-hint">Use a unique passphrase of at least 20 characters. Archives are limited to 128 MiB.</p>
    <label>Fresh authenticator code <input name="totp_code" inputmode="numeric" pattern="[0-9]{6}" maxlength="6" autocomplete="one-time-code" required></label>
    <p class="form-hint">Wait for a new code if you just used the current one to sign in.</p>
    <button type="submit">Download encrypted backup</button>
  </form>
</section>
<section class="card">
  <h2>Restore on a fresh host</h2>
  <ol><li>Install PKIMaster on the replacement host. Connect through localhost or an SSH tunnel.</li><li>Choose <strong>Restore an existing installation</strong> on the initial setup page before creating an administrator.</li><li>Stop the original installation, then upload the archive and enter its passphrase.</li><li>The packaged HTTPS service restarts automatically. Sign in with a restored account and authenticator, then check publication URLs, monitoring and key providers.</li></ol>
  <p>The destination keeps its current HTTPS address and port. The backup's CA identity and other settings are restored; all old browser sessions are invalidated.</p>
  <p class="form-hint">External PKCS#11 and Azure keys remain in their providers. The backup preserves their references and credentials, but the replacement host still needs access to those providers and their modules. Local managed SoftHSM token files are included. Remote publication files and system journal logs are outside the archive.</p>
</section>
{% endblock %}