# UNMS/UISP Backup/Restore — Full Sequence

## Nightly Backup Location
`/home/unms/data/unms-backups/backups/` — `YYYYMMDDHHMMSS-auto-<version>.unms` (~140MB)

- old server (5.161.225.131) → `s3://hermes-vps-backups/unms-backups/old-unms/`
- live server (152.53.39.202) → `s3://hermes-vps-backups/unms-backups/live/`
- UCRM DB → `s3://hermes-vps-backups/unms-backups/live/ucrm/`

## After Restore to New Server

**Order matters:** cert → device-ws → vault

### 1. Check UFW (netcup blocks all inbound except SSH)
```bash
ufw allow 80/tcp && ufw allow 443/tcp && ufw reload
```

### 2. Get Let's Encrypt certs
```bash
docker stop unms-nginx
certbot certonly --standalone --non-interactive --agree-tos \
  -m info@itpropartner.com \
  -d unms.forefrontwireless.com --preferred-challenges http
docker start unms-nginx
```

### 3. Inject certs into UNMS Nginx
```bash
cp /etc/letsencrypt/live/unms.forefrontwireless.com/fullchain.pem /home/unms/data/cert/live.crt
cp /etc/letsencrypt/live/unms.forefrontwireless.com/privkey.pem /home/unms/data/cert/live.key
chown unms:unms /home/unms/data/cert/live.*
chmod 600 /home/unms/data/cert/live.key
docker restart unms-nginx
```

### 4. Start WebSocket containers
```bash
for i in 1 2 3 4 5 6 7 8 9 10 11; do docker start unms-device-ws-$i; done
docker ps --format '{{.Names}} {{.Status}}' | grep device-ws
# All should show "Up X seconds (healthy)"
```

Without this, devices fail with: `connection error (host:443): HS: ws upgrade response not 101`

### 5. Vault key — destroyed on restore
Not recoverable from filesystem. Destroy via UI:
Settings → Credentials → Vault → Destroy Vault

### 6. Device connection string format
```
wss://unms.forefrontwireless.com:443+<token>+allowSelfSignedCertificate
```