pg_hardstorage |
PostgreSQL backup, done right. |
pg_hardstorage agent |
Run the host agent (loads config, runs scheduled backups + retention) |
pg_hardstorage anomaly |
Inspect backup metric baselines for outliers |
pg_hardstorage anomaly check |
Score the latest backup (or all backups with --all) against priors |
pg_hardstorage approval |
n-of-m approval workflow for destructive operations |
pg_hardstorage approval approve |
Approve an outstanding request |
pg_hardstorage approval list |
List approval requests in the repo |
pg_hardstorage approval purge-expired |
Record expiry for approval requests past their TTL (audited) |
pg_hardstorage approval request |
Create a new n-of-m approval request |
pg_hardstorage approval revoke |
Revoke an outstanding request (cannot be approved further) |
pg_hardstorage approval status |
Show the current status of a request |
pg_hardstorage audit |
Query the hash-chained audit log |
pg_hardstorage audit anchor |
Publish the chain head into the transparency log |
pg_hardstorage audit append |
Record a new event in the audit chain |
pg_hardstorage audit export-bundle |
Export a signed evidence bundle of audit events |
pg_hardstorage audit search |
Query audit events with filters |
pg_hardstorage audit summary |
Aggregate audit-event counts by action |
pg_hardstorage audit verify-anchor |
Compare the named anchor against the local chain |
pg_hardstorage audit verify-bundle |
Verify a signed audit evidence bundle |
pg_hardstorage audit verify-chain |
Walk the audit log and assert hash-chain integrity |
pg_hardstorage backup |
Take a backup of a deployment |
pg_hardstorage backup compare |
Diff two backups — file & chunk overlap, size delta, top-N changed files |
pg_hardstorage backup delete |
Soft-delete a specific backup (chunks reclaimed by next repo gc) |
pg_hardstorage backup graph |
Backup-chain topology + per-node dedup analysis |
pg_hardstorage backup undelete |
Resurrect one or more soft-deleted backups (removes tombstone marker) |
pg_hardstorage capacity |
Projected repository size, WAL volume, and pre-flight free-space checks |
pg_hardstorage capacity preflight |
Check whether the repo has free space for a projected backup |
pg_hardstorage capacity report |
Projected repository size and WAL volume |
pg_hardstorage changelog |
Show changelog |
pg_hardstorage classify |
Apply a data-classification tag to a deployment |
pg_hardstorage classify list |
Show every deployment's classification |
pg_hardstorage classify set |
Tag a deployment with public / internal / confidential / restricted |
pg_hardstorage compat |
Compatibility helpers for legacy backup tools |
pg_hardstorage compat translate |
Convert a legacy config to pg_hardstorage.yaml |
pg_hardstorage completion |
Generate shell completion scripts |
pg_hardstorage compliance |
Compliance reporting (SOC 2 / ISO 27001 / HIPAA / PCI / FedRAMP-friendly) |
pg_hardstorage compliance report |
Generate a time-windowed compliance report |
pg_hardstorage cost |
Per-deployment / per-tenant repository cost |
pg_hardstorage cost report |
Per-deployment / per-tenant repository cost |
pg_hardstorage db |
In-database integration (SQL views, upsert helpers) |
pg_hardstorage db install-extension |
Install the pg_hardstorage in-DB extension (creates schema + tables + views + functions) |
pg_hardstorage db uninstall-extension |
Remove the pg_hardstorage in-DB schema |
pg_hardstorage demo |
Run a throwaway end-to-end demo (init → backup → restore → verify) on a temporary PG in Docker |
pg_hardstorage deployment |
Manage deployments (add/list/remove/edit/test) |
pg_hardstorage deployment add |
Add a new deployment to the config |
pg_hardstorage deployment edit |
Update fields on an existing deployment |
pg_hardstorage deployment list |
List configured deployments |
pg_hardstorage deployment remove |
Remove a deployment from the config |
pg_hardstorage deployment test |
Probe PG for a configured deployment |
pg_hardstorage doctor |
Run health checks and suggest fixes |
pg_hardstorage dsa |
GDPR Data Subject Access helper: locate which backups contain a subject's data |
pg_hardstorage dsa list |
List DSA reports newest-first |
pg_hardstorage dsa locate |
Generate a signed DSA report for a subject + tenant |
pg_hardstorage dsa show |
Show one DSA report's full body + suggested actions |
pg_hardstorage dsa verify |
Re-validate the signature on a previously-stored DSA report |
pg_hardstorage explain |
Explain pg_hardstorage commands |
pg_hardstorage fleet |
Fleet-wide queries across deployments and backups |
pg_hardstorage fleet search |
Search every deployment's manifests in one repo |
pg_hardstorage forecast |
Capacity-planning + cost-projection report |
pg_hardstorage gameday |
Opt-in chaos automation |
pg_hardstorage gameday list |
List registered scenarios |
pg_hardstorage gameday report |
Aggregate recent gameday runs from the audit chain |
pg_hardstorage gameday run |
Run one chaos scenario, return structured Pass/Fail |
pg_hardstorage glossary |
Look up pg_hardstorage terminology |
pg_hardstorage hold |
Legal hold — pin backups against retention sweeps |
pg_hardstorage hold add |
Place a legal hold on a backup |
pg_hardstorage hold list |
List active legal holds |
pg_hardstorage hold purge-expired |
Remove every hold marker whose ExpiresAt is in the past |
pg_hardstorage hold remove |
Release a legal hold (the only way to clear one) |
pg_hardstorage init |
Day-0 setup wizard — connect, init repo, take first backup |
pg_hardstorage insider |
Insider-threat detection: scan the audit log for unusual patterns |
pg_hardstorage insider list |
List insider scans newest-first |
pg_hardstorage insider scan |
Run one insider-threat scan; persist the result |
pg_hardstorage insider show |
Show one scan's full body + findings |
pg_hardstorage integrity |
Continuous-attestation runs: re-verify manifests + chunks, sign the report |
pg_hardstorage integrity list |
List integrity runs newest-first |
pg_hardstorage integrity run |
Execute one continuous-attestation run; sign + persist; exit 9 on issues |
pg_hardstorage integrity show |
Show one integrity run's full body + per-failure detail |
pg_hardstorage integrity verify |
Re-validate the signature on a previously-stored run |
pg_hardstorage jit |
Just-in-time access tokens for break-glass operations |
pg_hardstorage jit issue |
Mint a new JIT access token |
pg_hardstorage jit list |
List JIT tokens with effective lifecycle status |
pg_hardstorage jit revoke |
Revoke a JIT token (writes a sibling .revoked marker) |
pg_hardstorage jit show |
Show one JIT token's full body + revocation status |
pg_hardstorage jit verify |
Verify a supplied JIT token is currently valid for an operation |
pg_hardstorage kms |
Manage encryption keys |
pg_hardstorage kms hsm-status |
Report PKCS#11 / TPM 2.0 binding state (deferred) |
pg_hardstorage kms inspect |
Read-only summary of the keyring |
pg_hardstorage kms rotate |
Re-wrap every encrypted backup's DEK with a new KEK |
pg_hardstorage kms shred |
Irreversibly destroy the local KEK (n-of-m approval REQUIRED) |
pg_hardstorage kms verify |
Verify the encryption envelope on every backup manifest in the repo |
pg_hardstorage lint |
Validate pg_hardstorage.yaml |
pg_hardstorage list |
List backups for a deployment, newest first |
pg_hardstorage llm |
LLM helper — grounded assistant with skill files, mandatory preview, full audit |
pg_hardstorage llm ask |
One-shot question answering |
pg_hardstorage llm chat |
Interactive chat session — REPL with /show-* transparency commands |
pg_hardstorage llm doctor |
Health check for the LLM helper subsystem |
pg_hardstorage llm explain |
Explain a CLI invocation in plain English |
pg_hardstorage llm export-session |
Export every audit event for an LLM session as a signed evidence bundle |
pg_hardstorage llm history |
Inspect / shred encrypted LLM conversation transcripts |
pg_hardstorage llm history list |
List recorded sessions for the operator (or all principals with --principal '*') |
pg_hardstorage llm history show |
Decrypt and print one session's transcript |
pg_hardstorage llm history shred |
Delete every session for the principal (irreversible without backups) |
pg_hardstorage llm skill |
Manage LLM skill files |
pg_hardstorage llm skill history |
List installed snapshots for a skill (most recent last) |
pg_hardstorage llm skill install |
Install a skill YAML file into the operator overlay (snapshots any existing version for rollback) |
pg_hardstorage llm skill lint |
Validate a skill YAML file (or a loaded skill name) |
pg_hardstorage llm skill list |
List loaded skills (precedence chain merged) |
pg_hardstorage llm skill rollback |
Revert a skill to its previous installed version |
pg_hardstorage llm skill show |
Show one loaded skill |
pg_hardstorage logical |
Configure logical decoding sinks alongside physical WAL streaming |
pg_hardstorage logical add |
Register a logical-decoding stream |
pg_hardstorage logical list |
List registered logical streams |
pg_hardstorage logical remove |
Remove a registered logical stream |
pg_hardstorage logical status |
Report registry state for one or all streams |
pg_hardstorage logical stream |
Run the long-lived consumer for a registered stream |
pg_hardstorage logs |
Tail the pg_hardstorage agent's systemd journal |
pg_hardstorage manifest |
Inspect backup manifests |
pg_hardstorage manifest show |
Show a single backup's full manifest |
pg_hardstorage notify |
Configure event sinks (slack, webhook, syslog, ...) |
pg_hardstorage notify add |
Add a sink to pg_hardstorage.yaml |
pg_hardstorage notify list |
List configured sinks |
pg_hardstorage notify remove |
Remove a sink by name |
pg_hardstorage partial |
Table-level inspection (v0.1) and restore |
pg_hardstorage partial dump |
Restore + start sandbox PG + pg_dump SQL for selected tables |
pg_hardstorage partial inspect |
Report which manifest entries a partial restore would touch |
pg_hardstorage partial restore |
Extract specific tables' files from a backup into --target |
pg_hardstorage patroni |
Read-only view of a Patroni-managed PostgreSQL cluster |
pg_hardstorage patroni follow |
Watch a Patroni cluster and stream leader-change events |
pg_hardstorage patroni history |
Print Patroni's timeline-history events |
pg_hardstorage patroni status |
Print the Patroni cluster topology + leader |
pg_hardstorage plugin |
Discover and inspect Tier-2 plugins |
pg_hardstorage plugin list |
List discovered Tier-2 plugins |
pg_hardstorage recovery |
Recovery-toolkit: readiness scorecard, PITR windows, and more |
pg_hardstorage recovery drill |
Run a full restore-and-verify drill against a real backup |
pg_hardstorage recovery drill history |
List + summarise past drill runs (auto-recorded by recovery drill) |
pg_hardstorage recovery readiness |
Single-screen recovery-readiness scorecard for one deployment |
pg_hardstorage recovery windows |
List every PITR window available for a deployment |
pg_hardstorage redact |
Post-restore PII redaction (rules-driven UPDATE statements) |
pg_hardstorage redact apply |
Apply a redaction rules file to a connected PostgreSQL cluster |
pg_hardstorage redact preview |
Preview the redaction plan without touching the database |
pg_hardstorage repair |
Targeted repair tools — explicit, idempotent, audited |
pg_hardstorage repair attestation |
Re-sign a manifest with the current keypair (audited) |
pg_hardstorage repair chunks |
Find chunks not referenced by any manifest, or manifests with missing chunks |
pg_hardstorage repair index |
Walk chunks/sha256/ and report the inventory |
pg_hardstorage repair manifest |
Reconcile a manifest's primary + replica copies (recover whichever side is missing/corrupt) |
pg_hardstorage repair scrub |
Verify chunk integrity (SHA-256 round-trip) across the repo |
pg_hardstorage repair slot |
Recreate a missing replication slot (alias for wal repair) |
pg_hardstorage repo |
Manage the repository |
pg_hardstorage repo audit |
Comprehensive read-only repository state report |
pg_hardstorage repo bundle |
Air-gap export/import of repo state (manifests + chunks + WAL) |
pg_hardstorage repo bundle export |
Export deployment state into an air-gap-transportable tar |
pg_hardstorage repo bundle import |
Import a previously-exported bundle into a destination repo (idempotent) |
pg_hardstorage repo check |
Verify repository integrity (signatures + chunk references) |
pg_hardstorage repo compact |
Compact small chunks into pack files (deferred) |
pg_hardstorage repo gc |
Reclaim space — sweep chunks no manifest references |
pg_hardstorage repo init |
Create a new repository at the given URL |
pg_hardstorage repo replicate |
Copy committed manifests + chunks from a source repo to a replica repo |
pg_hardstorage repo replicate verify |
Verify a replica repo is consistent with its source |
pg_hardstorage repo scrub |
Re-hash chunks to detect bit-rot (periodic maintenance) |
pg_hardstorage repo set-mode |
Toggle the repository's write-access posture |
pg_hardstorage repo usage |
Report repository usage by category |
pg_hardstorage repo wipe |
Permanently delete every object in the repo (n-of-m approval, or --force for non-WORM repos) |
pg_hardstorage residency |
Data-residency pinning for a deployment |
pg_hardstorage residency check |
Verify the configured repo's region matches the deployment's residency policy |
pg_hardstorage residency clear |
Remove residency constraint (allow any region) |
pg_hardstorage residency list |
Show every deployment's residency policy |
pg_hardstorage residency set |
Pin a deployment to one or more allowed regions |
pg_hardstorage restore |
Restore a backup to a target directory |
pg_hardstorage rotate |
Apply retention policy to a deployment (or all) |
pg_hardstorage runbook |
Generate a tailored runbook for the 3am operator |
pg_hardstorage runbook generate |
Render a runbook for + scenario as Markdown |
pg_hardstorage runbook list |
Enumerate available scenarios |
pg_hardstorage schedule |
Set, show, or list deployment backup/rotate schedules |
pg_hardstorage server |
Run the control plane |
pg_hardstorage show |
Show details of a single backup |
pg_hardstorage slo |
RPO / RTO SLOs as code |
pg_hardstorage slo clear |
Remove all SLO targets from a deployment |
pg_hardstorage slo report |
Compare actual RPO against target; flag misses |
pg_hardstorage slo set |
Declare RPO / RTO targets for a deployment |
pg_hardstorage slo show |
Display configured SLO targets |
pg_hardstorage standby |
Hot-standby restore — read-only replica fed entirely from the backup pipeline |
pg_hardstorage standby create |
Provision a hot-standby data dir from a backup |
pg_hardstorage standby destroy |
Remove a standby from the state file (data dir kept by default) |
pg_hardstorage standby list |
List recorded standbys |
pg_hardstorage status |
Show last-backup state for one or all deployments |
pg_hardstorage threshold |
k-of-n attestations: multi-party signing for highest-assurance manifests |
pg_hardstorage threshold attest |
Sign / verify / show k-of-n attestations |
pg_hardstorage threshold attest show |
Show one attestation: header + every signature with its validity |
pg_hardstorage threshold attest sign |
Add this operator's signature to an attestation (creates the header on first sign) |
pg_hardstorage threshold attest verify |
Verify the quorum on an attestation; exit 9 on quorum-not-met / tampering |
pg_hardstorage threshold roster |
Create / list / show rosters |
pg_hardstorage threshold roster create |
Admin-sign a new roster (refuses to overwrite an existing one) |
pg_hardstorage threshold roster list |
List rosters in the repository |
pg_hardstorage threshold roster show |
Show one roster's full body + members |
pg_hardstorage threshold whoami |
Print this operator's roster-member identity (signer line for admins) |
pg_hardstorage timetable |
Generate scheduling SQL for pg_timetable |
pg_hardstorage timetable emit |
Print (or directly install) pg_timetable SQL for the cron-friendly housekeeping commands |
pg_hardstorage timetravel |
Spin up an ephemeral read-only PG at a historical state |
pg_hardstorage timetravel cleanup |
Reap expired timetravel sessions |
pg_hardstorage timetravel create |
Provision a timetravel session pinned at --at |
pg_hardstorage timetravel destroy |
Remove a session from the state file (data dir kept by default) |
pg_hardstorage timetravel list |
List timetravel sessions (active by default) |
pg_hardstorage verify |
Verify a backup's signature and chunks (no restore required) |
pg_hardstorage version |
Print version information |
pg_hardstorage wal |
WAL transport: continuous streaming, push/fetch, list, repair |
pg_hardstorage wal audit |
Detect WAL gaps and alarm on findings (cron-friendly) |
pg_hardstorage wal fetch |
Fetch one WAL segment from the repository (restore_command shim) |
pg_hardstorage wal gap-purge |
Reap orphan WAL-gap records (or every record for a wiped deployment) |
pg_hardstorage wal gaps |
List persisted WAL-gap records (Patroni-failover diagnostics) |
pg_hardstorage wal list |
List committed WAL segments in the repository |
pg_hardstorage wal preflight |
Validate PostgreSQL configuration for WAL streaming |
pg_hardstorage wal prune |
Delete WAL segment manifests no kept backup can use for recovery |
pg_hardstorage wal push |
Archive one segment via archive_command (PG-invoked) |
pg_hardstorage wal repair |
Recreate a missing replication slot; report any LSN gap |
pg_hardstorage wal stream |
Continuously stream WAL into the repository |