MySQL/MariaDB backup tool for Windows Server — standalone .exe, no Docker required

This is a fork of databasus/databasus focused on Windows Server deployment as a self-contained .exe. No Docker or Kubernetes required. Primary backup targets are MySQL and MariaDB. The original project also supports PostgreSQL, MongoDB, Docker-based and Kubernetes deployments — see the upstream repository for those.

Features • Installation • Usage • License • Contributing

🌐 Databasus website

---

✨ Features

💾 Supported databases

• MySQL: 5.7, 8 and 9
• MariaDB: 10, 11 and 12

🔄 Scheduled backups

• Flexible scheduling: hourly, daily, weekly, monthly or cron
• Precise timing: run backups at specific times (e.g., 4 AM during low traffic)
• Smart compression: 4-8x space savings with balanced compression (~20% overhead)

🔄 Restore

Restoring a backup to a database is fully supported. Select a backup, choose the target database and credentials, and Databasus streams the restore directly — no intermediate files.

🧪 Restore verification (docs)

Requires Docker — not available in this deployment. Restore verification spins up a temporary database container to confirm backups are restorable. It is supported in the upstream Docker-based deployment.

Databasus performs a real restore to confirm backups are usable, not just intact on disk or checksum check.

• Triggers: after each backup or on a flexible schedule (hourly, daily, weekly, monthly or cron)
• Real restore: spins up a database container, runs the restore and checks the restored size against the backup
• Report: lists every table with its row count
• Optional notifications: send the report or failure-only alerts through any configured notifier

🗑️ Retention policies

• Time period: Keep backups for a fixed duration (e.g., 7 days, 3 months, 1 year)
• Count: Keep a fixed number of the most recent backups (e.g., last 30)
• GFS (Grandfather-Father-Son): Layered retention — keep hourly, daily, weekly, monthly and yearly backups independently for fine-grained long-term history (enterprises requirement)
• Size limits: Set per-backup and total storage size caps to control storage usage

🗄️ Multiple storage destinations (view supported)

• Local storage: Keep backups on your VPS/server
• Cloud storage: S3, Cloudflare R2, Google Drive, NAS, Dropbox, SFTP, Rclone and more
• Secure: All data stays under your control

📱 Notifications (view supported)

• Multiple channels: Email, Telegram, Slack, Discord, webhooks
• Real-time updates: Success and failure notifications
• Team integration: Perfect for DevOps workflows

🔒 Enterprise-grade security (docs)

• AES-256-GCM encryption: Enterprise-grade protection for backup files
• Zero-trust storage: Backups are encrypted and remain useless to attackers, so you can safely store them in shared storage like S3, Azure Blob Storage, etc.
• Encryption for secrets: Any sensitive data is encrypted and never exposed, even in logs or error messages
• Read-only user: Databasus uses a read-only user by default for backups and never stores anything that can modify your data

It is also important for Databasus that you are able to decrypt and restore backups from storages (local, S3, etc.) without Databasus itself. To do so, read our guide on how to recover directly from storage. We avoid "vendor lock-in" even to open source tool!

👥 Suitable for teams (docs)

• Workspaces: Group databases, notifiers and storages for different projects or teams
• Access management: Control who can view or manage specific databases with role-based permissions
• Audit logs: Track all system activities and changes made by users
• User roles: Assign viewer, member, admin or owner roles within workspaces

🎨 UX-Friendly

• Designer-polished UI: Clean, intuitive interface crafted with attention to detail
• Dark & light themes: Choose the look that suits your workflow
• Mobile adaptive: Check your backups from anywhere on any device

🔌 Connection types

• Remote — Databasus connects directly to the database over the network (recommended in read-only mode). No agent or additional software required. Works with cloud-managed and self-hosted databases
• Agent — A lightweight Databasus agent (written in Go) runs alongside the database. The agent streams backups directly to Databasus, so the database never needs to be exposed publicly. Supports host-installed databases and Docker containers

📦 Backup types

• Logical — Native dump of the database in its engine-specific binary format. Compressed and streamed directly to storage with no intermediate files
• Physical — File-level copy of the entire database cluster. PostgreSQL only; not applicable to MySQL/MariaDB targets

🐳 Self-hosted & secure

• Standalone .exe: runs on Windows Server with no Docker, no Kubernetes, and no external services required
• Privacy-first: All your data stays on your infrastructure
• Open source: Apache 2.0 licensed, inspect every line of code

---

➕ Enhancements over upstream

Features added in this fork that are not present in databasus/databasus:

Backup: limit to tables

When configuring a database for backup, an Advanced settings → Limit to tables field lets you back up only a specific subset of tables instead of the entire database. When set, the backup uses mariadb-dump/mysqldump's positional table argument, and the "Exclude tables" field is disabled.

Restore: limit to tables

When restoring a backup, an Advanced settings → Limit to tables field lets you restore only specific tables from a full dump. Useful when you need to retrieve a few rows from an older backup without touching the rest of the database. Databasus streams and filters the SQL dump in-process — no intermediate files.

---

📦 Installation

Pre-built binaries are published to the GitHub releases page automatically when a version tag is pushed:

git tag windows-v1.0.0
git push origin windows-v1.0.0

The CI builds databasus.zip and attaches it to the release. If no release is available yet, follow the Building from source section below.

Download databasus.zip and extract it to a dedicated directory, for example C:\databasus\:

C:\databasus\
├── databasus.exe
├── install-service.bat
└── install-service.ps1

That's the entire installation — no Docker, no extra tools, no configuration file. The UI and all database client tools are embedded inside databasus.exe and extracted automatically on first launch.

First run (manual)

To run Databasus manually (e.g. for testing), open PowerShell inside C:\databasus\ and run:

.\databasus.exe --standalone

The binary extracts client tools, initialises an embedded database, applies all migrations, and serves the web UI on port 4005. Access the dashboard at http://localhost:4005. No configuration file is required.

Installing as a Windows Service (recommended)

To have Databasus start automatically at every Windows boot, install it as a service. Right-click install-service.bat and choose Run as administrator.

The script will:

1. Register Databasus as a Windows Service set to start automatically
2. Configure automatic restart on crash (restarts after 5 seconds)
3. Start the service immediately
4. Display the service status and log file location

To manage the service afterwards (run in PowerShell as Administrator):

Start-Service Databasus   # start
Stop-Service  Databasus   # stop
Get-Service   Databasus   # status

To uninstall the service:

.\databasus.exe --uninstall-service

Updating

The service registration and databasus-data\ folder are untouched during an update — only the exe is replaced. Windows locks executables while they are running, so the service must be stopped first:

# Run as Administrator
Stop-Service Databasus
# Replace databasus.exe with the new version here
Start-Service Databasus

Firewall

To access the dashboard from other machines on the network, open port 4005:

netsh advfirewall firewall add rule `
    name="Databasus" protocol=TCP dir=in action=allow localport=4005

Data and encryption key

All runtime data — internal database, encryption key, client tools, and any locally-stored backups — is written to databasus-data\ in the same directory as databasus.exe. Back up this directory regularly. The encryption key in particular must be preserved: without it, encrypted backups stored on S3 or other remote storage cannot be decrypted, even if you reinstall Databasus.

Service logs are written to databasus-data\databasus.log.

---

🚀 Usage

1. Access the dashboard: Navigate to http://localhost:4005
2. Add your first database for backup: Click "New Database" and follow the setup wizard
3. Configure schedule: Choose from hourly, daily, weekly, monthly or cron intervals
4. Set database connection: Enter your database credentials and connection details
5. Choose storage: Select where to store your backups (local, S3, Google Drive, etc.)
6. Configure retention policy: Choose time period, count or GFS to control how long backups are kept
7. Add notifications (optional): Configure email, Telegram, Slack, or webhook notifications
8. Save and start: Databasus will validate settings and begin the backup schedule

🔑 Resetting password

If you need to reset the password, stop Databasus and run:

.\databasus.exe --new-password="YourNewSecurePassword123" --email="admin@example.com"

Replace the email with the actual address of the user whose password you want to reset.

💾 Backing up Databasus itself

See Data and encryption key in the Installation section.

---

🛡️ Security & reliability engineering

Databasus works with sensitive data, so preventing vulnerabilities, unauthorised access and data leaks is a primary concern. We invest in this in the code itself: permission checks, encryption, and careful handling of secrets.

Critical paths are covered by both unit and integration tests.

Found a vulnerability? Report it via the GitHub Security tab. See SECURITY.md. Security reports are the highest-priority work queue. For runtime application security (AES-256-GCM at rest, zero-trust storage, encrypted secrets, read-only DB user by default) see Enterprise-grade security in the Features section above.

---

🔨 Building from source

The CI release pipeline builds and packages databasus.zip automatically on every tagged release. If you need to build locally:

Prerequisites: Go 1.26.3+, Node.js 20+, pnpm, and the swag CLI for Swagger doc generation.

# Install swag
go install github.com/swaggo/swag/cmd/swag@v1.16.4

# Install frontend dependencies (once)
cd frontend && pnpm install --frozen-lockfile && cd ..

# Generate Swagger docs (required for the cmd package to compile)
cd backend && swag init -d . -g cmd/main.go -o swagger && cd ..

Build and package:

cd backend
make build-windows

This single command builds the React frontend, embeds it and all client tools into the binary, cross-compiles for Windows amd64, and produces dist-windows/databasus.zip containing:

databasus.exe
install-service.bat
install-service.ps1

---

📝 License

This project is licensed under the Apache 2.0 License - see the LICENSE file for details

🤝 Contributing

Contributions are welcome! Open an issue or pull request on GitHub. For the upstream project's broader contributing guide see databasus.com/contribute.

FAQ

AI disclaimer

Windows standalone port (this fork)

This port to a self-contained Windows .exe was written and reviewed entirely by AI (Claude Code). The maintainer directed the work and made architectural decisions, but did not perform line-by-line code review.

Original project (databasus/databasus)

AI is used as a helper for:

• verification of code quality and searching for vulnerabilities
• cleaning up and improving documentation, comments and code
• assistance during development
• double-checking PRs and commits after human review

AI is not used for:

• writing entire code
• "vibe code" approach
• code without line-by-line verification by a human
• code without tests

AI is an assistant to increase productivity and ensure code quality. All work is verified line-by-line by a human before merging.