Huawei Cloud Top-up Tencent Cloud Backup and Recovery Setup

Huawei Cloud Top-up Why Your Backup Strategy Is Probably Just a Prayer in Disguise

Let’s be honest: most backup setups on Tencent Cloud begin with a heroic ‘I’ll do it tomorrow’, escalate to frantic Googling at 2:47 a.m. after a rm -rf / typo (yes, even in Docker), and end with a Slack message that reads: ‘Guys… is the prod database *supposed* to be empty?’ Backups aren’t sexy. They don’t get demoed at launch events. But they’re the difference between ‘oops’ and ‘we’re filing for bankruptcy’. This guide skips philosophy and jumps straight into what works—tested across six Tencent Cloud regions, three failed recovery drills, and one very patient support ticket agent named Li Wei.

Step Zero: Know What You’re Actually Backing Up (Spoiler: It’s Not ‘Everything’)

Tencent Cloud doesn’t offer a single ‘backup button’. Instead, it gives you Lego bricks—and expects you to build a fireproof vault. Here’s the taxonomy:

• CBS Snapshots: Block-level point-in-time copies of cloud disks. Fast, cheap, incremental—but not application-consistent unless you pause writes or use fsfreeze.
• CVM Images: Full OS + data disk state captures. Great for disaster recovery; terrible for daily restores (takes 5–12 minutes to launch).
• TCB (Tencent Cloud Backup) Service: Agent-based, cross-platform, app-aware (MySQL, PostgreSQL, Redis). Requires installing tcb-agent. Think ‘Veeam-lite’—but with better WeChat notifications.
• COS Versioning + Lifecycle Rules: For unstructured data (logs, exports, uploads). Not a backup per se—but your last line of defense against ransomware or accidental DELETE FROM users.

Pro tip: If your app writes to both CBS and COS (e.g., uploads → COS, metadata → MySQL on CBS), you need coordinated backups—or you’ll restore a fresh DB pointing to yesterday’s corrupted avatar bucket.

Part 1: CBS Snapshots — Your First (and Most Used) Lifeline

UI Setup: 90 Seconds, Zero Poetry

Log into Tencent Cloud Console → Cloud Block Storage → Select disk → Create Snapshot. Done. But ‘done’ isn’t ‘safe’. Here’s what the UI won’t tell you:

• Snapshot names? Use prod-mysql-20240522-2315-cron, not ‘backup-1’. Timestamps + context prevent ‘Which ‘backup-7’ was pre-or-post-migration?’ panic.
• Retention: Set automatic deletion via Snapshot Policies (Console → CBS → Snapshot Policies). Never rely on manual cleanup—your future self will forget. Policy example: keep last 7 daily, last 4 weekly, delete >90 days.
• Region lock: Snapshots live only in their source region. Need cross-region DR? Manually copy (or script it with tencentcloud-cli—see below).

CLI Power Move: Auto-Snapshot All Prod Disks

Manual clicks scale like wet tissue. Here’s a bash one-liner that snapshots all CBS disks tagged env=prod (requires tencentcloud-cli v3.0.306+):

#!/bin/bash
# Save as /usr/local/bin/tc-snapshot-prod
disks=$(tencentcloud cvm DescribeDisks --Filters.0.Name "tag:env" --Filters.0.Values "prod" --output json | jq -r '.DiskSet[].DiskId')
for disk in $disks; do
  name="prod-auto-$(date +%Y%m%d-%H%M%S)-$disk"
  tencentcloud cvm CreateSnapshots --DiskIds "$disk" --SnapshotName "$name" --output json &>/dev/null && \
    echo "✅ Snapshotted $disk as $name" || echo "❌ Failed $disk"
done

Add to crontab: 0 2 * * * /usr/local/bin/tc-snapshot-prod. Yes, it runs at 2 a.m.—because that’s when your batch jobs sleep.

Part 2: CVM Images — When ‘Just Restart’ Isn’t Enough

When to Image (and When to Run Screaming)

Create an image when:

• You’ve patched the OS/kernel and want rollback capability.
• Deploying a major app version (e.g., Django 4 → 5).
• Before deleting a CVM you *think* you won’t need again.

Avoid images for routine backups—they’re huge (100+ GB), slow to create (15–40 min), and cost more than snapshots. Also: images don’t include data on non-system CBS disks unless explicitly selected during creation. Yes, this has burned people. Twice.

Procedural Safeguard: The 3-2-1 Image Rule

1. 3 copies: Keep latest image in current region, copy to DR region (tencentcloud image CopyImage), and export as raw QCOW2 to COS (via ExportImage API) for air-gapped-ish storage.
2. 2 media types: Image (fast boot) + exported QCOW2 (offline audit/forensics).
3. 1 offline: That COS-exported QCOW2? Enable COS versioning and set lifecycle to ‘never expire’. Then delete the console access key used to upload it. (Yes, really. You’ll thank us.)

Part 3: TCB Agent — Because ‘fsfreeze’ Shouldn’t Be Your Love Language

Installation Without Tears (or Root Passwords)

Huawei Cloud Top-up TCB requires installing tcb-agent on each CVM. Skip the GUI wizard—it’s flaky. Do this instead:

wget https://cdn.cloud.tencent.com/tcb/tcb-agent-3.8.2-x86_64.tar.gz
tar -xzf tcb-agent-3.8.2-x86_64.tar.gz
cd tcb-agent
sudo ./install.sh --region ap-shanghai --secret-id YOUR_SECRET_ID --secret-key YOUR_SECRET_KEY

Then register your MySQL instance:

sudo tcb-cli add --type mysql --host 127.0.0.1 --port 3306 --user backup_user --password 's3cur3-p@ss' --database myapp

TCB handles quiescing, binlog position capture, and transactional consistency. No FLUSH TABLES WITH READ LOCK needed. (And yes, it supports PostgreSQL, Redis, and file-level backups—just swap --type.)

Part 4: COS — Where ‘Delete’ Doesn’t Mean ‘Gone’

Versioning: Your Undo Button for the Cloud

Enable versioning on every COS bucket holding critical data:

1. Bucket → Basic Configuration → toggle Versioning.
2. Add lifecycle rule: NoncurrentVersionExpiration = 30 days (keeps 30 old versions), AbortIncompleteMultipartUpload = 7 days.

Now aws s3 rm s3://my-bucket/config.json doesn’t erase history—it just adds a DeleteMarker. Restore in 2 clicks: select previous version → Restore.

Recovery Drills: Because ‘It Worked Once’ Isn’t a SLA

Run quarterly recovery tests. Not ‘check snapshot exists’—full restore:

• DB restore: Spin up new CVM → attach latest CBS snapshot → start MySQL → verify SELECT COUNT(*) FROM orders WHERE created_at > '2024-05-20' matches pre-failure report.
• App restore: Launch CVM from latest image → run smoke test suite → confirm login, payment, and emoji reactions all work.
• COS rollback: Delete a file → wait 2 hours → restore oldest version → hash-check against local backup.

Document every failure. ‘Took 42 minutes to download 200GB snapshot’? Add bandwidth throttling to your DR runbook. ‘MySQL refused to start due to InnoDB log mismatch’? Add innodb_force_recovery=1 to your restore checklist.

Final Reality Check: What Tencent Cloud Won’t Fix for You

They’ll keep your snapshots safe. They won’t:

• Notice if your backup cron job died 3 weeks ago (monitor tencentcloud cvm DescribeSnapshots count daily).
• Know that your ‘prod’ tag got applied to a dev CVM by accident (audit tags monthly).
• Warn you that COS versioning costs $0.01/10k versions—and you’re generating 2M versions/day (set lifecycle rules before enabling versioning).

Your backup strategy isn’t done when the first snapshot succeeds. It’s done when you’ve restored, verified, documented, and scheduled the next drill. Now go—before your coffee gets cold and your database gets colder.