[Bug]: Restore fails due to missing Encryption Profile ID despite imported master key (Smart Recovery not applied)

[chris-20]

DBackup Version

v2.5.0

Installation Method

Docker (docker-compose)

Bug Description

When attempting to restore an encrypted configuration backup, the restore process fails because the required Encryption Profile cannot be found, even after importing the corresponding master key via the Disaster Recovery function.

The following error is displayed:

Restore Failed: Encryption Profile cmpwiez0i0000o001tnb4yv7s not found. Please ensure the relevant Encryption Profile is restored first.

Improvement

It would be beneficial to allow the encryption key or encryption profile to be directly provided or selected within the Backup Restore Wizard.

This would eliminate the dependency on pre-imported profiles or separate Disaster Recovery steps and significantly improve the simplicity and reliability of the restore process, particularly in fresh or cold-start environments.

Steps to Reproduce

1. Prepare an encrypted backup:

   • config_backup_2026-06-02T10-52-29-551Z.json.gz.enc

   • config_backup_2026-06-02T10-52-29-551Z.json.gz.enc.meta.json

2. Create a new instance for restoring the backup (fresh environment)

3. Navigate to Security Vault → Import Key

4. Import the 256-bit master key

5. Navigate to the DBackup Restore Interface

6. Select the encrypted backup and start the restore process

7. The system reports a missing Encryption Profile:

   cmpwiez0i0000o001tnb4yv7s

8. Open Import Master Key (Disaster Recovery) and re-import/confirm the master key

9. Retry the restore process

10. The restore still fails with the same missing Encryption Profile erro

Expected Behavior

I expected the restore process to succeed after importing the master key via Security Vault → Import Key and confirming it again through Import Master Key (Disaster Recovery).

Specifically, I expected the system to correctly resolve the missing Encryption Profile (cmpwiez0i0000o001tnb4yv7s) using the provided master key, allowing the backup to be decrypted and restored without additional manual intervention or missing dependency errors.

Logs / Error Output

Screenshots

No response

Environment

No response

[Skyfay]

Hey @chris-20

Thanks for creating this issue.

Is this about Config Backups/Restore or Database Backups/Restore?

There is a smart recovery which should check every key if the old profile is not available.

[chris-20]

Hey @chris-20

Thanks for creating this issue.

Is this about Config Backups/Restore or Database Backups/Restore?

There is a smart recovery which should check every key if the old profile is not available.

Hey @Skyfay,

this is about Configuration Backup / Restore, specifically the system settings backup under:

Dashboard → Settings → System Settings → Configuration Backup

Not about Database Backups/Restore.

[chris-20]

Backup Settings:

[chris-20]

Here is a small improvement suggestion: It would be very helpful if all necessary information could be entered directly in this step in order to fully restore the backup without any additional intermediate steps.

In particular, it would be a valuable enhancement to allow the encryption key to be entered directly. Additionally, it could be useful to provide the option to import the entire folder that was originally used for encryption, so that the previous system can be restored as closely as possible in a 1:1 manner

[Skyfay]

Thanks for the informations.

Could you maybe try the config restore trough the storage explorer? This is always the preferred way, because you can also restore only specific settings.

I'm actually not sure right now whether it makes sense to keep developing the config backup feature. In theory, you could just back up the SQLite database. I think that covers 99% of the use cases. But I'm open to hearing a different opinion on that :)

[Skyfay]

Hey @chris-20

I just tested the config restore trough the way i mentioned above:

This works fine. I'll see if I can fix the other problem as well.

[Skyfay]

I just realized that this issue also occurs when downloading via Storage Explorer if you try to download a decrypted file unencrypted. Of course, the error occurs because neither location supports Smart Recovery, unlike the Restore feature. I'm working on a general solution for this problem.

[Skyfay]

@chris-20 This issue will be fixed v2.5.1.

There is now also a smart recovery feature that should work. If that doesn't work, you can also enter the key manually. So you don't have to import it into the vault first, even for a disaster recovery. But you can if you want.

I hope that helps, and thank you very much for reporting the bug.

[chris-20]

Thanks for the quick feedback and for looking into it!
The update sounds great, v2.5.1 looks promising—looking forward to it.

[Skyfay]

Just released v2.5.1

Feel free to give it a try and let me know what you think :)