Recovery

The Recovery page is where you move a whole server — its platform brain, databases and volumes — between any two hosts, on any provider. It's the operational surface over the same four verbs described in Backups & recovery: capture, restore, clone, and relocate-to-new-IP. This page adds a transfer-mode picker and a live view of jobs running across your fleet.

It needs the recovery.run privilege; without it the page shows a locked notice.

Choosing a transfer mode

Three cards describe how an image gets from a source to its destination — all using the same .hsi format:

Mode	Tag	What it does
Offline / Download	air-gapped	Capture to an encrypted .hsi image you download or push to object storage, then restore anywhere. No live link between boxes.
Peer transfer	transfer key	Stream the image box-to-box over a one-time transfer key. The target pulls directly from the source — fastest when both hosts are online.
Managed migration	relocate to new IP	HostSSH provisions the fresh VPS, restores the brain and databases, rewrites IP references, re-issues TLS, flips DNS, then verifies row counts and 200s before cutover.

These launch buttons are previews today. Capture, transfer, and migration execute on the agent; the control plane queues them once an agent is connected. Until then the buttons announce the preview state honestly rather than asserting work that didn't run. The wired path for loading a snapshot onto a Node is Load snapshot on the Images page.

Live jobs and history

Two badges in the header show how many jobs are active and the total count. Below the transfer modes, four stat tiles: Active jobs, Servers in scope, Succeeded, and Failed (highlighted when non-zero).

Active jobs — each in-flight capture, restore, clone or migration renders as a card with a live progress bar, a row of step dots (pending / active / done / failed), and its source → target. Badges flag the transfer mode and whether the job relocates to a new IP. When nothing is running, you get a "Nothing running" empty state.

Job history — a table of completed and failed jobs:

Column	What it shows
Kind	capture, restore, restore-drill, clone, or migrate.
Status	succeeded, failed, running, or verifying.
Source → Target	Which hosts the job moved between.
Mode	Offline / Peer / Managed, if set.
New IP	A badge when the job relocated to a new IP.
Started	When it began.
Result	For a captured image: its size and how many databases and volumes it holds. A failed job reads "aborted — see audit".

Restore-drills

A restore-drill is a restore job whose only purpose is to prove recoverability — it appears here as its own kind alongside real restores. This is the discipline HostSSH is built around: a backup you haven't restored isn't a backup. Scheduling a monthly drill is covered in Getting started and Backups & recovery.

Related

• Backups & recovery — the four verbs, IP rewrite, and the .hsi format in depth.
• Images — the snapshot ledger and the wired Load snapshot flow.
• Provisioning — where a managed migration's fresh VPS comes from.