A single lightweight binary for automated MySQL, PostgreSQL, MongoDB, and SQLite backups. Client-side age encryption, an Argon2id vault, and native sync to Google Drive, Cloudflare R2, AWS S3, and local storage.
Linux • macOS (Apple Silicon & Intel) • Zero runtime dependencies
Database credentials, S3 secret keys, and bot tokens are stored in an encrypted local vault (secrets.enc) using Argon2id key derivation and AES-256-GCM authenticated encryption.
Backups can be streamed directly into modern age (X25519) encryption before uploading. Unattended servers only need the public recipient key; your private keys stay cold.
When configuring MySQL or PostgreSQL, dbk dynamically discovers databases on the host and lets you pick from a menu instead of memorizing and manually typing catalog names.
Stream directly to Google Drive (Service Account), Cloudflare R2 (zero egress fees), AWS S3, MinIO, Wasabi, Backblaze B2, or local/NFS mounts with automatic retention pruning.
No memory-leaking background daemon. Registers headless scheduled jobs directly with systemd timers, UNIX cron, or Windows Task Scheduler with 1 click.
Detects new GitHub releases in the background, alerts you with a modal in the TUI, verifies SHA-256 digests against checksums.txt, and safely replaces the binary in-place.
Memory-bounded Unix pipe streaming: never buffers multi-gigabyte databases entirely into RAM.
Step-by-step instructions to obtain API keys and service credentials for your preferred storage destination.
No interactive browser login required. Unattended, robust, and headless.
Go to Google Cloud Console, click the project selector, and click New Project (e.g. dbk-backups).
Navigate to APIs & Services > Library. Search for Google Drive API, select it, and click Enable.
Go to Credentials > Create Credentials > Service Account. Name it dbk-backup-agent and finish.
Open the service account > Keys tab > Add Key > Create new key > JSON. This downloads your service account JSON file.
Copy the service account email (dbk-agent@your-project.iam.gserviceaccount.com).
Open Google Drive, create a folder, right-click > Share > paste the service account email with Editor permission.
Open the shared folder in your browser. Copy the ID at the end of the URL:
1A2B3C4D5E6F7G8H9I0JKLMNOP# 1. Via TUI: Open dbk → Storage → Press 'a' → Select 'gdrive'
# 2. Paste Folder ID & Service Account JSON (stored securely in vault)
dbk secret set storage/gdrive/credentials --stdin < service-account.json
Tailored wizards that ask only for engine-relevant configuration.
Automatic discovery of all databases on the PostgreSQL server. Supports standard SQL streams or custom archive format. TLS enabled.
Auto-discovers schemas. Streams single-transaction consistent dumps with compression directly to target storage backends.
Connects via host/port or URI. Streams BSON archives for full collections, indexes, and metadata without intermediate disk usage.
Single-field path wizard: only asks for the database file path. No host, user, or port fields. Safe consistent backup copies.
Run headless in cron jobs, CI/CD pipelines, Docker containers, or scripts.
Launches the full interactive Bubble Tea TUI interface
Runs on-demand headless backup for a job and exits (pass --quiet --json for scripts)
Interactively lists historical backup snapshots and safely restores into target database
Registers unattended backup timer with OS scheduler (systemd timer, cron, or Task Scheduler)
Checks GitHub for newer releases, verifies SHA-256 digest, and atomically upgrades binary in-place
Exports full configuration and vault secrets into an encrypted portable transfer bundle
# Install latest binary directly via verified installer:
$ curl -fsSL https://raw.githubusercontent.com/tanzid64/tui-db-manager/main/install.sh | sh
# Or install with Go toolchain:
$ go install github.com/tanzid64/tui-db-manager/cmd/dbk@latest
# Launch dbk:
$ dbk