I have had automatic backups running on this box for as long as I have had this box. Nightly, encrypted, one copy on the machine and one copy off it. Every morning the sensor says the last one succeeded, and every morning I believe it, and for about two years that was the entire extent of my disaster recovery plan: a green checkmark and a feeling.
A green checkmark is not a plan. It tells you a file was written. It says nothing about whether that file, plus you, plus a Saturday afternoon, adds up to a working house. So a couple of weekends ago I did the thing I had been putting off: I reinstalled Home Assistant OS on the EliteDesk from scratch and restored the whole home from a backup, deliberately, while nothing was actually broken.
The good news is that the restore worked. The interesting news is everything I found out in the ninety minutes around it.
Why rehearse when nothing is on fire
Because the alternative is rehearsing at the worst possible moment. The night the SSD gives up is the night you discover that the encryption key lives in a password manager you can only unlock on the phone whose 2FA app is… you see where this goes. Failure modes love company.
Home Assistant’s own backup emergency kit documentation is unusually blunt about this, and I appreciate it: if you have lost the encryption key and no longer have access to your instance, there is no way to restore the backup. Nabu Casa does not keep a copy and cannot decrypt it for you. There is no support ticket that ends well. That is the correct design — it is my house data — but it does mean the key is a single point of failure that no amount of nightly archiving protects you from.
There is a second, subtler trap on that same page: if you have ever rotated your encryption key, the new key does not open older backups. You need the key that matches the archive. I had rotated mine once, in some tidying-up mood, and had genuinely not thought about what that meant for the six-month-old backup still sitting on my NAS.
The drill, in the order it happened
I did not restore onto the production disk. The whole point of a rehearsal is that failing it should be free, so I pulled the EliteDesk’s SSD, dropped in a spare NVMe I had lying around, and installed Home Assistant OS clean on that. Ten minutes of work, and it meant the real system was untouched in a drawer the entire time — worst case, swap the drive back and go make coffee.
Then: boot, wait for onboarding, and instead of creating a new account, choose to restore from a backup. That path is built into the onboarding flow now, which is a much saner order of operations than the old dance of setting up a throwaway account first. Upload the archive, paste the key, wait.
The restore itself took about twenty-five minutes for a roughly 1.8 GB backup, most of which was the recorder database and Frigate’s config. It came back up on the same hostname, with my dashboards, my automations, my entity IDs, my add-ons, my HACS repositories, and — the part I was most curious about — my Zigbee network intact, once I moved the coordinator stick over to the same rear USB port it had been living in. (I have opinions about that port.) No re-pairing. Nothing to re-adopt.
So: the archive did its job. Which brings me to the part that did not go smoothly.
What the backup could not give back
A Home Assistant backup contains Home Assistant. It does not contain the house around it, and my house had accumulated more undocumented state than I wanted to admit.
The DHCP reservation for the box lives on my router, not in the archive. So does the static lease for the Shelly relays. The BIOS on the EliteDesk had a specific setting — restore power state after AC loss — that I had set once in 2024 and completely forgotten about, and a fresh drive obviously does not restore firmware settings. Two ESPHome devices had been flashed with an OTA password I had stored precisely nowhere except in the ESPHome config the archive did helpfully return, so that one was luck rather than planning. My phone’s companion app needed re-onboarding. And the little cron job on my NAS that pulls the nightly backup off the box was authenticating with a token tied to a user account that came back fine — but I had to look up how it worked, because I had never written it down.
None of that was hard. All of it was slow, and all of it would have been much slower at 23:00 on a weeknight with the lights not responding and someone reasonably asking why the house had stopped working.
The 2026.8 change that will surprise someone
Worth flagging if your next reinstall lands on current firmware. As of 2026.8, new installations of Home Assistant OS drop the :8123 suffix and answer on a normal web address. Existing installs are completely unchanged — nothing to do, nothing breaks — but a fresh install is a new install, so my rehearsal box came up somewhere my muscle memory did not expect.
I want to be fair here: this is a good change. The port number was always trivia everyone had to learn for no reason. And the new web server settings screen has a genuinely thoughtful safety net — change the port, and Home Assistant waits for you to confirm it still works, then rolls back and restarts if you do not confirm within five minutes. You cannot easily lock yourself out. But it does mean that if you restore a config that expects one port onto an install that defaults to another, bookmarks and any tool pointed at the old address may need a nudge.
What I changed afterwards
Four things, all small.
First, a recovery note. Plain markdown, kept outside the house, listing the router reservations, the BIOS settings I care about, which USB port the coordinator lives in, and the order to bring things back up. It took twenty minutes to write because I had just done all of it and it was still fresh. That is the actual value of a rehearsal: it turns tribal knowledge into a file.
Second, both encryption keys — current and the one I rotated away from — printed on paper and filed with the boring household documents. Yes, paper. It survives a dead phone, a dead laptop, and a dead me, which is more than my password manager can claim under all three conditions.
Third, an actual third location. I had two copies, which is one hardware failure away from one copy. Since 2026.7, Dropbox joined Google Drive and OneDrive as a native backup destination, so there are now three reasonable off-box options in the UI without custom components. I will admit the tension for a local-first setup: an off-site copy means my house data sits on someone else’s disk. Encrypted, and with the key never leaving my hands — but still. I decided a fire is a more realistic threat to me than a storage provider reading an AES-encrypted archive, and that is a judgement call, not a rule. If you land the other way, a drive at a relative’s place is a perfectly respectable third location.
Fourth, and this one I should have had years ago: the backup integration exposes an event entity that reports failed along with a failed_reason attribute, plus sensors for the last attempted and last successful backup. So instead of glancing at a card and assuming, I now get a push notification when a backup fails, with the reason in the message. The docs even hand you the automation. Silence is now meaningful, which it never was before.
If you only do one thing
You do not have to pull your SSD out. The cheap version of this drill: spin up Home Assistant OS in a VM on whatever laptop you have, restore last night’s backup into it, and see how far you get before you need something that is not in the archive. Write down every one of those moments. That list is your real recovery plan, and it is almost certainly longer than you expect.
The backup integration ships with Home Assistant and, per the docs, runs on 94.3% of active installations. It has been there since 2022.4. Almost all of us have it. The gap is not the backup — it is that a backup you have never restored is a hypothesis, and the only way to turn it into a safety net is to test it on a day when failing costs you nothing but an afternoon.
Mine cost me an afternoon and a slightly bruised ego about how much of this house lives only in my head. Cheapest ninety minutes I have spent on this setup.
Leave a Reply