Merge remote-tracking branch 'origin/next' into v5-parallel-inertia-react

app/Actions/Shared/DeleteScheduledVolumeBackup.php

@@ -0,0 +1,71 @@
+<?php
+
+namespace App\Actions\Shared;
+
+use App\Jobs\VolumeBackupJob;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Server;
+use Illuminate\Support\Facades\Cache;
+use Lorisleiva\Actions\Concerns\AsAction;
+
+class DeleteScheduledVolumeBackup
+{
+    use AsAction;
+
+    public function handle(ScheduledVolumeBackup $backup, ?Server $server = null): void
+    {
+        $lock = Cache::lock(VolumeBackupJob::lockKey($backup->id), $backup->timeout + 300);
+
+        if (! $lock->get()) {
+            throw new \RuntimeException('Wait for the queued or running storage backup to finish before deleting this schedule.');
+        }
+
+        try {
+            if ($backup->executions()
+                ->where(fn ($query) => $query
+                    ->where('status', 'running')
+                    ->orWhere('stop_recovery_pending', true)
+                    ->orWhere('s3_cleanup_pending', true))
+                ->exists()) {
+                throw new \RuntimeException('Wait for the running storage backup and recovery operations to finish before deleting this schedule.');
+            }
+
+            $localFilenames = $backup->executions()
+                ->where('local_storage_deleted', false)
+                ->pluck('filename')
+                ->filter()
+                ->all();
+
+            if ($localFilenames !== []) {
+                $server ??= $backup->server();
+                if (! $server) {
+                    throw new \RuntimeException('The server is unavailable, so local backup archives cannot be deleted.');
+                }
+
+                deleteBackupsLocally($localFilenames, $server, throwError: true);
+            }
+
+            $s3Executions = $backup->executions()
+                ->with('s3')
+                ->where('s3_uploaded', true)
+                ->where('s3_storage_deleted', false)
+                ->get();
+
+            foreach ($s3Executions->groupBy('s3_storage_id') as $executions) {
+                $s3 = $executions->first()->s3;
+                if (! $s3) {
+                    throw new \RuntimeException('The S3 storage used by an existing backup is unavailable.');
+                }
+
+                $filenames = $executions->pluck('filename')->filter()->all();
+                if ($filenames !== []) {
+                    deleteBackupsS3($filenames, $s3);
+                }
+            }
+
+            $backup->delete();
+        } finally {
+            $lock->release();
+        }
+    }
+}

app/Http/Controllers/Api/ApplicationsController.php

@@ -4910,6 +4910,8 @@ class ApplicationsController extends Controller
             ], 422);
         }
 
+        $storage->abortIfScheduledBackupsExist();
+
         if ($storage instanceof LocalFileVolume) {
             $storage->deleteStorageOnServer();
         }

app/Http/Controllers/Api/DatabasesController.php

@@ -4484,6 +4484,8 @@ class DatabasesController extends Controller
             ], 422);
         }
 
+        $storage->abortIfScheduledBackupsExist();
+
         if ($storage instanceof LocalFileVolume) {
             $storage->deleteStorageOnServer();
         }

app/Http/Controllers/Api/ServicesController.php

@@ -2911,6 +2911,8 @@ class ServicesController extends Controller
             ], 422);
         }
 
+        $storage->abortIfScheduledBackupsExist();
+
         if ($storage instanceof LocalFileVolume) {
             $storage->deleteStorageOnServer();
         }

app/Http/Controllers/Api/VolumeBackupsController.php

@@ -0,0 +1,445 @@
+<?php
+
+namespace App\Http\Controllers\Api;
+
+use App\Actions\Shared\DeleteScheduledVolumeBackup;
+use App\Http\Controllers\Controller;
+use App\Models\Application;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use App\Models\S3Storage;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\Service;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\MessageBag;
+use OpenApi\Attributes as OA;
+use RuntimeException;
+
+#[OA\Schema(
+    schema: 'VolumeBackupScheduleRequest',
+    required: ['frequency'],
+    properties: [
+        new OA\Property(property: 'frequency', type: 'string', maxLength: 255, example: '0 2 * * *'),
+        new OA\Property(property: 'enabled', type: 'boolean', default: true),
+        new OA\Property(property: 'save_s3', type: 'boolean', default: false),
+        new OA\Property(property: 'disable_local_backup', type: 'boolean', default: false),
+        new OA\Property(property: 'stop_during_backup', type: 'boolean', default: false),
+        new OA\Property(property: 's3_storage_uuid', type: 'string', nullable: true),
+        new OA\Property(property: 'retention_amount_locally', type: 'integer', default: 7, minimum: 0, maximum: 10000),
+        new OA\Property(property: 'retention_days_locally', type: 'integer', default: 0, maximum: 2147483647, minimum: 0),
+        new OA\Property(property: 'retention_max_storage_locally', type: 'number', format: 'float', default: 0, maximum: 9999999999, minimum: 0),
+        new OA\Property(property: 'retention_amount_s3', type: 'integer', default: 7, minimum: 0, maximum: 10000),
+        new OA\Property(property: 'retention_days_s3', type: 'integer', default: 0, maximum: 2147483647, minimum: 0),
+        new OA\Property(property: 'retention_max_storage_s3', type: 'number', format: 'float', default: 0, maximum: 9999999999, minimum: 0),
+        new OA\Property(property: 'timeout', type: 'integer', default: 3600, minimum: 60, maximum: 36000),
+    ],
+    type: 'object',
+    additionalProperties: false,
+)]
+#[OA\Schema(
+    schema: 'VolumeBackupScheduleResponse',
+    required: ['uuid', 'message', 'storage_uuid', 'storage_type', 'frequency', 'enabled', 'save_s3', 'disable_local_backup', 'stop_during_backup', 'retention_amount_locally', 'retention_days_locally', 'retention_max_storage_locally', 'retention_amount_s3', 'retention_days_s3', 'retention_max_storage_s3', 'timeout'],
+    properties: [
+        new OA\Property(property: 'uuid', type: 'string'),
+        new OA\Property(property: 'message', type: 'string'),
+        new OA\Property(property: 'storage_uuid', type: 'string'),
+        new OA\Property(property: 'storage_type', type: 'string', enum: ['persistent', 'directory']),
+        new OA\Property(property: 'frequency', type: 'string'),
+        new OA\Property(property: 'enabled', type: 'boolean'),
+        new OA\Property(property: 'save_s3', type: 'boolean'),
+        new OA\Property(property: 'disable_local_backup', type: 'boolean'),
+        new OA\Property(property: 'stop_during_backup', type: 'boolean'),
+        new OA\Property(property: 's3_storage_uuid', type: 'string', nullable: true),
+        new OA\Property(property: 'retention_amount_locally', type: 'integer'),
+        new OA\Property(property: 'retention_days_locally', type: 'integer'),
+        new OA\Property(property: 'retention_max_storage_locally', type: 'number', format: 'float'),
+        new OA\Property(property: 'retention_amount_s3', type: 'integer'),
+        new OA\Property(property: 'retention_days_s3', type: 'integer'),
+        new OA\Property(property: 'retention_max_storage_s3', type: 'number', format: 'float'),
+        new OA\Property(property: 'timeout', type: 'integer'),
+    ],
+    type: 'object',
+)]
+class VolumeBackupsController extends Controller
+{
+    #[OA\Put(
+        summary: 'Set application storage backup schedule',
+        description: 'Create or replace the backup schedule for an application persistent volume or directory storage.',
+        path: '/applications/{uuid}/storages/{storage_uuid}/backups',
+        operationId: 'set-application-storage-backup-schedule',
+        security: [['bearerAuth' => []]],
+        requestBody: new OA\RequestBody(required: true, content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleRequest')),
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, description: 'UUID of the application.', schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'storage_uuid', in: 'path', required: true, description: 'UUID of the persistent volume or directory storage.', schema: new OA\Schema(type: 'string')),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Backup schedule replaced.', content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleResponse')),
+            new OA\Response(response: 201, description: 'Backup schedule created.', content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleResponse')),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    #[OA\Put(
+        summary: 'Set database storage backup schedule',
+        description: 'Create or replace the backup schedule for a database persistent volume or directory storage.',
+        path: '/databases/{uuid}/storages/{storage_uuid}/backups',
+        operationId: 'set-database-storage-backup-schedule',
+        security: [['bearerAuth' => []]],
+        requestBody: new OA\RequestBody(required: true, content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleRequest')),
+        tags: ['Databases'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, description: 'UUID of the database.', schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'storage_uuid', in: 'path', required: true, description: 'UUID of the persistent volume or directory storage.', schema: new OA\Schema(type: 'string')),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Backup schedule replaced.', content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleResponse')),
+            new OA\Response(response: 201, description: 'Backup schedule created.', content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleResponse')),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    #[OA\Put(
+        summary: 'Set service storage backup schedule',
+        description: 'Create or replace the backup schedule for a service persistent volume or directory storage.',
+        path: '/services/{uuid}/storages/{storage_uuid}/backups',
+        operationId: 'set-service-storage-backup-schedule',
+        security: [['bearerAuth' => []]],
+        requestBody: new OA\RequestBody(required: true, content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleRequest')),
+        tags: ['Services'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, description: 'UUID of the service.', schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'storage_uuid', in: 'path', required: true, description: 'UUID of the persistent volume or directory storage.', schema: new OA\Schema(type: 'string')),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Backup schedule replaced.', content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleResponse')),
+            new OA\Response(response: 201, description: 'Backup schedule created.', content: new OA\JsonContent(ref: '#/components/schemas/VolumeBackupScheduleResponse')),
+            new OA\Response(response: 400, ref: '#/components/responses/400'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 422, ref: '#/components/responses/422'),
+        ],
+    )]
+    public function upsert(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $invalidRequest = validateIncomingRequest($request);
+        if ($invalidRequest instanceof JsonResponse) {
+            return $invalidRequest;
+        }
+
+        $resourceType = $request->route('resource_type');
+        $resource = $this->findResource($resourceType, $request->route('uuid'), $teamId);
+        if (! $resource) {
+            return response()->json([
+                'message' => match ($resourceType) {
+                    'application' => 'Application not found.',
+                    'database' => 'Database not found.',
+                    'service' => 'Service not found.',
+                    default => 'Resource not found.',
+                },
+            ], 404);
+        }
+
+        $this->authorize('update', $resource);
+
+        $storage = $this->findStorage($resource, $request->route('storage_uuid'));
+        if (! $storage) {
+            return response()->json(['message' => 'Storage not found.'], 404);
+        }
+
+        ['errors' => $errors, 's3Storage' => $s3Storage, 'saveToS3' => $saveToS3] = $this->validateUpsertRequest($request, $storage, $teamId);
+
+        if ($errors->isNotEmpty()) {
+            return response()->json([
+                'message' => 'Validation failed.',
+                'errors' => $errors,
+            ], 422);
+        }
+
+        return $this->persistSchedule($request, $storage, $teamId, $s3Storage, $saveToS3, $resourceType, $resource);
+    }
+
+    /**
+     * @return array{errors: MessageBag, s3Storage: S3Storage|null, saveToS3: bool}
+     */
+    private function validateUpsertRequest(
+        Request $request,
+        LocalPersistentVolume|LocalFileVolume $storage,
+        int|string $teamId,
+    ): array {
+        $validator = customApiValidator($request->all(), [
+            'frequency' => 'required|string|max:255',
+            'enabled' => 'boolean',
+            'save_s3' => 'boolean',
+            'disable_local_backup' => 'boolean',
+            'stop_during_backup' => 'boolean',
+            's3_storage_uuid' => 'nullable|string',
+            'retention_amount_locally' => 'integer|min:0|max:10000',
+            'retention_days_locally' => 'integer|min:0|max:2147483647',
+            'retention_max_storage_locally' => 'numeric|min:0|max:9999999999',
+            'retention_amount_s3' => 'integer|min:0|max:10000',
+            'retention_days_s3' => 'integer|min:0|max:2147483647',
+            'retention_max_storage_s3' => 'numeric|min:0|max:9999999999',
+            'timeout' => 'integer|min:60|max:36000',
+        ]);
+        $errors = $validator->errors();
+        $allowedFields = [
+            'frequency',
+            'enabled',
+            'save_s3',
+            'disable_local_backup',
+            'stop_during_backup',
+            's3_storage_uuid',
+            'retention_amount_locally',
+            'retention_days_locally',
+            'retention_max_storage_locally',
+            'retention_amount_s3',
+            'retention_days_s3',
+            'retention_max_storage_s3',
+            'timeout',
+        ];
+
+        foreach (array_diff(array_keys($request->all()), $allowedFields) as $field) {
+            $errors->add($field, 'This field is not allowed.');
+        }
+
+        if (! $errors->has('frequency') && ! validate_cron_expression($request->string('frequency')->toString())) {
+            $errors->add('frequency', 'The frequency must be a valid cron or human expression.');
+        }
+
+        $saveToS3 = $request->boolean('save_s3');
+        if ($request->boolean('disable_local_backup') && ! $saveToS3) {
+            $errors->add('disable_local_backup', 'Local backups can only be disabled when S3 backups are enabled.');
+        }
+
+        $s3Storage = null;
+        if ($saveToS3) {
+            $s3Storage = S3Storage::query()
+                ->where('team_id', $teamId)
+                ->where('is_usable', true)
+                ->where('uuid', $request->input('s3_storage_uuid'))
+                ->first();
+
+            if (! $s3Storage) {
+                $errors->add('s3_storage_uuid', 'Select a usable S3 storage owned by your team.');
+            }
+        }
+
+        if ($storage instanceof LocalFileVolume && (! $storage->is_directory || $storage->is_host_file)) {
+            $errors->add('storage_uuid', 'Only directory file storages can be backed up.');
+        }
+
+        return [
+            'errors' => $errors,
+            's3Storage' => $s3Storage,
+            'saveToS3' => $saveToS3,
+        ];
+    }
+
+    private function persistSchedule(
+        Request $request,
+        LocalPersistentVolume|LocalFileVolume $storage,
+        int|string $teamId,
+        ?S3Storage $s3Storage,
+        bool $saveToS3,
+        string $resourceType,
+        Model $resource,
+    ): JsonResponse {
+        $backup = $storage->scheduledBackups()->updateOrCreate([], [
+            'team_id' => $teamId,
+            'frequency' => $request->string('frequency')->toString(),
+            'enabled' => $request->boolean('enabled', true),
+            'save_s3' => $saveToS3,
+            'disable_local_backup' => $saveToS3 && $request->boolean('disable_local_backup'),
+            'stop_during_backup' => $request->boolean('stop_during_backup'),
+            's3_storage_id' => $s3Storage?->id,
+            'retention_amount_locally' => $request->integer('retention_amount_locally', 7),
+            'retention_days_locally' => $request->integer('retention_days_locally'),
+            'retention_max_storage_locally' => $request->float('retention_max_storage_locally'),
+            'retention_amount_s3' => $request->integer('retention_amount_s3', 7),
+            'retention_days_s3' => $request->integer('retention_days_s3'),
+            'retention_max_storage_s3' => $request->float('retention_max_storage_s3'),
+            'timeout' => $request->integer('timeout', 3600),
+        ]);
+        $created = $backup->wasRecentlyCreated;
+
+        auditLog('api.volume_backup.schedule_set', [
+            'team_id' => $teamId,
+            'resource_type' => $resourceType,
+            'resource_uuid' => $resource->uuid,
+            'storage_uuid' => $storage->uuid,
+            'backup_uuid' => $backup->uuid,
+        ]);
+
+        return response()->json($this->responseData($backup, $storage, $s3Storage, $created), $created ? 201 : 200);
+    }
+
+    #[OA\Delete(
+        summary: 'Delete application storage backup schedule',
+        description: 'Delete the backup schedule and its local and S3 archives for an application storage.',
+        path: '/applications/{uuid}/storages/{storage_uuid}/backups',
+        operationId: 'delete-application-storage-backup-schedule',
+        security: [['bearerAuth' => []]],
+        tags: ['Applications'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'storage_uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Backup schedule and archives deleted.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 409, description: 'Backup or recovery operation is still running.'),
+        ],
+    )]
+    #[OA\Delete(
+        summary: 'Delete database storage backup schedule',
+        description: 'Delete the backup schedule and its local and S3 archives for a database storage.',
+        path: '/databases/{uuid}/storages/{storage_uuid}/backups',
+        operationId: 'delete-database-storage-backup-schedule',
+        security: [['bearerAuth' => []]],
+        tags: ['Databases'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'storage_uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Backup schedule and archives deleted.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 409, description: 'Backup or recovery operation is still running.'),
+        ],
+    )]
+    #[OA\Delete(
+        summary: 'Delete service storage backup schedule',
+        description: 'Delete the backup schedule and its local and S3 archives for a service storage.',
+        path: '/services/{uuid}/storages/{storage_uuid}/backups',
+        operationId: 'delete-service-storage-backup-schedule',
+        security: [['bearerAuth' => []]],
+        tags: ['Services'],
+        parameters: [
+            new OA\Parameter(name: 'uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+            new OA\Parameter(name: 'storage_uuid', in: 'path', required: true, schema: new OA\Schema(type: 'string')),
+        ],
+        responses: [
+            new OA\Response(response: 200, description: 'Backup schedule and archives deleted.'),
+            new OA\Response(response: 401, ref: '#/components/responses/401'),
+            new OA\Response(response: 403, description: 'Forbidden.'),
+            new OA\Response(response: 404, ref: '#/components/responses/404'),
+            new OA\Response(response: 409, description: 'Backup or recovery operation is still running.'),
+        ],
+    )]
+    public function destroy(Request $request): JsonResponse
+    {
+        $teamId = getTeamIdFromToken();
+        if (is_null($teamId)) {
+            return invalidTokenResponse();
+        }
+
+        $resourceType = $request->route('resource_type');
+        $resource = $this->findResource($resourceType, $request->route('uuid'), $teamId);
+        if (! $resource) {
+            return response()->json(['message' => 'Resource not found.'], 404);
+        }
+
+        $this->authorize('update', $resource);
+
+        $storage = $this->findStorage($resource, $request->route('storage_uuid'));
+        if (! $storage) {
+            return response()->json(['message' => 'Storage not found.'], 404);
+        }
+
+        $backup = $storage->scheduledBackups()->first();
+        if (! $backup) {
+            return response()->json(['message' => 'Storage backup schedule not found.'], 404);
+        }
+
+        try {
+            DeleteScheduledVolumeBackup::run($backup);
+        } catch (RuntimeException $exception) {
+            return response()->json(['message' => $exception->getMessage()], 409);
+        }
+
+        auditLog('api.volume_backup.schedule_deleted', [
+            'team_id' => $teamId,
+            'resource_type' => $resourceType,
+            'resource_uuid' => $resource->uuid,
+            'storage_uuid' => $storage->uuid,
+            'backup_uuid' => $backup->uuid,
+        ]);
+
+        return response()->json(['message' => 'Storage backup schedule and archives deleted.']);
+    }
+
+    private function findResource(string $resourceType, string $uuid, int|string $teamId): ?Model
+    {
+        return match ($resourceType) {
+            'application' => Application::ownedByCurrentTeamAPI($teamId)->where('uuid', $uuid)->first(),
+            'database' => queryDatabaseByUuidWithinTeam($uuid, $teamId),
+            'service' => Service::query()->whereRelation('environment.project.team', 'id', $teamId)->where('uuid', $uuid)->first(),
+            default => null,
+        };
+    }
+
+    private function findStorage(Model $resource, string $storageUuid): LocalPersistentVolume|LocalFileVolume|null
+    {
+        if ($resource instanceof Service) {
+            foreach ($resource->applications->concat($resource->databases) as $serviceResource) {
+                $storage = $this->findStorage($serviceResource, $storageUuid);
+                if ($storage) {
+                    return $storage;
+                }
+            }
+
+            return null;
+        }
+
+        $storage = $resource->persistentStorages()->where('uuid', $storageUuid)->first();
+
+        return $storage ?? $resource->fileStorages()->where('uuid', $storageUuid)->first();
+    }
+
+    private function responseData(
+        ScheduledVolumeBackup $backup,
+        LocalPersistentVolume|LocalFileVolume $storage,
+        ?S3Storage $s3Storage,
+        bool $created,
+    ): array {
+        return [
+            'uuid' => $backup->uuid,
+            'message' => $created ? 'Storage backup schedule created.' : 'Storage backup schedule updated.',
+            'storage_uuid' => $storage->uuid,
+            'storage_type' => $storage instanceof LocalFileVolume ? 'directory' : 'persistent',
+            'frequency' => $backup->frequency,
+            'enabled' => $backup->enabled,
+            'save_s3' => $backup->save_s3,
+            'disable_local_backup' => $backup->disable_local_backup,
+            'stop_during_backup' => $backup->stop_during_backup,
+            's3_storage_uuid' => $s3Storage?->uuid,
+            'retention_amount_locally' => $backup->retention_amount_locally,
+            'retention_days_locally' => $backup->retention_days_locally,
+            'retention_max_storage_locally' => $backup->retention_max_storage_locally,
+            'retention_amount_s3' => $backup->retention_amount_s3,
+            'retention_days_s3' => $backup->retention_days_s3,
+            'retention_max_storage_s3' => $backup->retention_max_storage_s3,
+            'timeout' => $backup->timeout,
+        ];
+    }
+}

app/Jobs/DatabaseBackupJob.php

@@ -497,7 +497,7 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
                 }
             }
             if ($this->backup_log && $this->backup_log->status === 'success') {
-                removeOldBackups($this->backup);
+                $this->removeExpiredBackups();
             }
         } catch (Throwable $e) {
             throw $e;
@@ -513,6 +513,19 @@ class DatabaseBackupJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function removeExpiredBackups(): void
+    {
+        try {
+            removeOldBackups($this->backup);
+        } catch (Throwable $exception) {
+            Log::channel('scheduled-errors')->warning('Database backup retention cleanup failed', [
+                'backup_id' => $this->backup->id,
+                'execution_id' => $this->backup_log?->id,
+                'error' => $exception->getMessage(),
+            ]);
+        }
+    }
+
     private function backup_standalone_mongodb(string $databaseWithCollections): void
     {
         try {

app/Jobs/DeleteResourceJob.php

@@ -7,7 +7,10 @@ use App\Actions\Database\StopDatabase;
 use App\Actions\Server\CleanupDocker;
 use App\Actions\Service\DeleteService;
 use App\Actions\Service\StopService;
+use App\Actions\Shared\DeleteScheduledVolumeBackup;
+use App\Enums\ApplicationDeploymentStatus;
 use App\Models\Application;
+use App\Models\ApplicationDeploymentQueue;
 use App\Models\ApplicationPreview;
 use App\Models\Service;
 use App\Models\StandaloneClickhouse;
@@ -42,6 +45,10 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
 
     public function handle()
     {
+        if (! $this->resource instanceof ApplicationPreview) {
+            $this->deleteScheduledVolumeBackups();
+        }
+
         try {
             // Handle ApplicationPreview instances separately
             if ($this->resource instanceof ApplicationPreview) {
@@ -113,6 +120,24 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
         }
     }
 
+    private function deleteScheduledVolumeBackups(): void
+    {
+        $server = data_get($this->resource, 'server') ?? data_get($this->resource, 'destination.server');
+        $resources = $this->resource instanceof Service
+            ? $this->resource->applications()->get()->concat($this->resource->databases()->get())
+            : collect([$this->resource]);
+
+        foreach ($resources as $resource) {
+            $storages = $resource->persistentStorages()->get()->concat($resource->fileStorages()->get());
+
+            foreach ($storages as $storage) {
+                foreach ($storage->scheduledBackups()->get() as $backup) {
+                    DeleteScheduledVolumeBackup::run($backup, $server);
+                }
+            }
+        }
+    }
+
     private function deleteApplicationPreview()
     {
         $application = $this->resource->application;
@@ -125,11 +150,11 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
         }
 
         // Cancel any active deployments for this PR (same logic as API cancel_deployment)
-        $activeDeployments = \App\Models\ApplicationDeploymentQueue::where('application_id', $application->id)
+        $activeDeployments = ApplicationDeploymentQueue::where('application_id', $application->id)
             ->where('pull_request_id', $pull_request_id)
             ->whereIn('status', [
-                \App\Enums\ApplicationDeploymentStatus::QUEUED->value,
-                \App\Enums\ApplicationDeploymentStatus::IN_PROGRESS->value,
+                ApplicationDeploymentStatus::QUEUED->value,
+                ApplicationDeploymentStatus::IN_PROGRESS->value,
             ])
             ->get();
 
@@ -137,7 +162,7 @@ class DeleteResourceJob implements ShouldBeEncrypted, ShouldQueue
             try {
                 // Mark deployment as cancelled
                 $activeDeployment->update([
-                    'status' => \App\Enums\ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
+                    'status' => ApplicationDeploymentStatus::CANCELLED_BY_USER->value,
                 ]);
 
                 // Add cancellation log entry

app/Jobs/ScheduledJobManager.php

@@ -2,8 +2,11 @@
 
 namespace App\Jobs;
 
+use App\Actions\Shared\DeleteScheduledVolumeBackup;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ScheduledTask;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
 use App\Models\Server;
 use App\Models\Team;
 use Cron\CronExpression;
@@ -109,6 +112,16 @@ class ScheduledJobManager implements ShouldQueue
             ]);
         }
 
+        try {
+            $this->recoverStoppedVolumeBackupContainers();
+            $this->processScheduledVolumeBackups();
+        } catch (\Exception $e) {
+            Log::channel('scheduled-errors')->error('Failed to process scheduled volume backups', [
+                'error' => $e->getMessage(),
+                'trace' => $e->getTraceAsString(),
+            ]);
+        }
+
         // Process Docker cleanups - don't let failures stop the job manager
         try {
             $this->processDockerCleanups();
@@ -341,6 +354,112 @@ class ScheduledJobManager implements ShouldQueue
         }
     }
 
+    private function processScheduledVolumeBackups(): void
+    {
+        ScheduledVolumeBackup::query()
+            ->with(['backupable', 'team.subscription'])
+            ->where('enabled', true)
+            ->chunkById(self::CHUNK_SIZE, function ($backups): void {
+                foreach ($backups as $backup) {
+                    $this->processScheduledVolumeBackup($backup);
+                }
+            });
+    }
+
+    private function recoverStoppedVolumeBackupContainers(): void
+    {
+        ScheduledVolumeBackupExecution::query()
+            ->where(fn (Builder $query) => $query
+                ->where('stop_recovery_pending', true)
+                ->orWhere('s3_cleanup_pending', true))
+            ->chunkById(self::CHUNK_SIZE, function ($executions): void {
+                foreach ($executions as $execution) {
+                    VolumeBackupRecoveryJob::dispatch($execution);
+                }
+            });
+    }
+
+    private function processScheduledVolumeBackup(ScheduledVolumeBackup $backup): void
+    {
+        try {
+            $server = $backup->server();
+
+            if ($backup->executions()
+                ->where(fn (Builder $query) => $query
+                    ->where('stop_recovery_pending', true)
+                    ->orWhere('s3_cleanup_pending', true))
+                ->exists()) {
+                $this->skippedCount++;
+                $this->logSkip('volume_backup', 'container_recovery_pending', [
+                    'backup_id' => $backup->id,
+                    'team_id' => $backup->team_id,
+                ]);
+
+                return;
+            }
+
+            if (! $backup->backupable) {
+                DeleteScheduledVolumeBackup::run($backup, $server);
+                $this->skippedCount++;
+                $this->logSkip('volume_backup', 'resource_deleted', [
+                    'backup_id' => $backup->id,
+                    'team_id' => $backup->team_id,
+                ]);
+
+                return;
+            }
+
+            if (! $server) {
+                $this->skippedCount++;
+                $this->logSkip('volume_backup', 'server_missing', [
+                    'backup_id' => $backup->id,
+                    'team_id' => $backup->team_id,
+                ]);
+
+                return;
+            }
+
+            if (! $server->isFunctional()) {
+                $this->skippedCount++;
+                $this->logSkip('volume_backup', 'server_not_functional', [
+                    'backup_id' => $backup->id,
+                    'team_id' => $backup->team_id,
+                    'server_id' => $server->id,
+                ]);
+
+                return;
+            }
+
+            if (isCloud() && $backup->team_id !== 0 && ! data_get($backup, 'team.subscription.stripe_invoice_paid', false)) {
+                $this->skippedCount++;
+                $this->logSkip('volume_backup', 'subscription_unpaid', [
+                    'backup_id' => $backup->id,
+                    'team_id' => $backup->team_id,
+                    'server_id' => $server->id,
+                ]);
+
+                return;
+            }
+
+            if ($this->shouldDispatch($backup->frequency, $server, "scheduled-volume-backup:{$backup->id}")) {
+                VolumeBackupJob::dispatch($backup);
+                $this->dispatchedCount++;
+                Log::channel('scheduled')->info('Volume backup dispatched', [
+                    'backup_id' => $backup->id,
+                    'backupable_type' => $backup->backupable_type,
+                    'backupable_id' => $backup->backupable_id,
+                    'team_id' => $backup->team_id,
+                    'server_id' => $server->id,
+                ]);
+            }
+        } catch (\Exception $e) {
+            Log::channel('scheduled-errors')->error('Error processing volume backup', [
+                'backup_id' => $backup->id,
+                'error' => $e->getMessage(),
+            ]);
+        }
+    }
+
     private function getBackupSkipReason(ScheduledDatabaseBackup $backup, ?Server $server): ?string
     {
         if (blank(data_get($backup, 'database'))) {

app/Jobs/VolumeBackupJob.php

@@ -0,0 +1,443 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Events\BackupCreated;
+use App\Models\LocalPersistentVolume;
+use App\Models\ScheduledVolumeBackup;
+use App\Models\ScheduledVolumeBackupExecution;
+use App\Models\Server;
+use App\Rules\SafeWebhookUrl;
+use Carbon\Carbon;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\Middleware\WithoutOverlapping;
+use Illuminate\Queue\SerializesModels;
+use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Log;
+use Throwable;
+
+class VolumeBackupJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $maxExceptions = 1;
+
+    public int $timeout = 3600;
+
+    private ?ScheduledVolumeBackupExecution $execution = null;
+
+    public function __construct(public ScheduledVolumeBackup $backup)
+    {
+        $this->onQueue(crons_queue());
+        $this->timeout = $backup->timeout ?? 3600;
+    }
+
+    public function middleware(): array
+    {
+        return [
+            (new WithoutOverlapping('volume-backup-'.$this->backup->id))
+                ->shared()
+                ->expireAfter($this->timeout + 60)
+                ->dontRelease(),
+        ];
+    }
+
+    public static function lockKey(int $backupId): string
+    {
+        return 'laravel-queue-overlap:volume-backup-'.$backupId;
+    }
+
+    public function handle(): void
+    {
+        $this->backup->loadMissing(['backupable.resource', 'team', 's3']);
+        $server = $this->backup->server();
+        $target = $this->backup->backupable;
+        $team = $this->backup->team;
+
+        if (! $server || ! $target || ! $team) {
+            throw new \RuntimeException('The storage backup resource, team, or server no longer exists.');
+        }
+
+        $this->execution = $this->backup->executions()->create([
+            's3_storage_id' => $this->backup->save_s3 ? $this->backup->s3_storage_id : null,
+        ]);
+        BackupCreated::dispatch($team->id);
+
+        $backupDirectory = backup_dir().'/volumes/'.str($team->name)->slug().'-'.$team->id.'/'.$target->uuid;
+        $filename = str($this->backup->targetType())->lower().'-'.str($this->backup->targetName())->slug().'-'.Carbon::now()->timestamp.'.tar.gz';
+        $backupLocation = $backupDirectory.'/'.$filename;
+        $this->execution->update(['filename' => $backupLocation]);
+
+        try {
+            $source = $this->backup->sourcePath();
+            $containerName = 'volume-backup-'.$this->execution->uuid;
+            $image = coolifyHelperImage().':'.getHelperVersion();
+            $verifySourceCommand = $target instanceof LocalPersistentVolume && blank($target->host_path)
+                ? 'docker volume inspect '.escapeshellarg($source).' >/dev/null'
+                : 'test -d '.escapeshellarg($source);
+
+            $archiveCommand = 'docker run --rm --name '.escapeshellarg($containerName)
+                .' -v '.escapeshellarg($source.':/volume:ro')
+                .' '.escapeshellarg($image)
+                .' tar -czf - -C /volume . > '.escapeshellarg($backupLocation);
+
+            if ($this->backup->stop_during_backup) {
+                $containers = $this->containersUsingVolume($source, $server);
+                if ($containers !== []) {
+                    $this->execution->update(['stop_recovery_pending' => true]);
+                    $archiveCommand = $this->archiveWithStoppedContainers(
+                        $archiveCommand,
+                        $containers,
+                        VolumeBackupRecoveryJob::stateFile($this->execution),
+                    );
+                }
+            }
+
+            instant_remote_process([
+                $verifySourceCommand,
+                'mkdir -p '.escapeshellarg($backupDirectory),
+                $archiveCommand,
+            ], $server, timeout: $this->timeout, disableMultiplexing: true);
+            $this->execution->update([
+                'stop_container_ids' => null,
+                'stop_recovery_pending' => false,
+            ]);
+
+            $size = (int) instant_remote_process(
+                ['du -b '.escapeshellarg($backupLocation).' | cut -f1'],
+                $server,
+                disableMultiplexing: true,
+            );
+
+            if ($size <= 0) {
+                throw new \RuntimeException('The storage backup archive is empty or was not created.');
+            }
+
+            $warning = null;
+            $s3Uploaded = null;
+            $s3CleanupPending = false;
+            $localStorageDeleted = false;
+
+            if ($this->backup->save_s3) {
+                $s3CleanupPending = true;
+                $this->execution->update(['s3_cleanup_pending' => true]);
+
+                try {
+                    $this->uploadToS3($backupLocation, $backupDirectory, $server);
+                    $s3Uploaded = true;
+                    $s3CleanupPending = false;
+                } catch (Throwable $exception) {
+                    $s3Uploaded = false;
+                    $warning = 'S3 upload failed: '.$exception->getMessage();
+
+                    try {
+                        VolumeBackupRecoveryJob::cleanupS3Upload($this->execution);
+                        $s3CleanupPending = false;
+                    } catch (Throwable $cleanupException) {
+                        VolumeBackupRecoveryJob::dispatch($this->execution);
+                        $warning .= ' Partial S3 upload cleanup failed: '.$cleanupException->getMessage();
+                    }
+                }
+
+                if ($s3Uploaded && $this->backup->disable_local_backup) {
+                    try {
+                        deleteBackupsLocally($backupLocation, $server, throwError: true);
+                        $localStorageDeleted = true;
+                    } catch (Throwable $exception) {
+                        $warning = 'S3 upload succeeded, but the local archive could not be deleted: '.$exception->getMessage();
+                    }
+                }
+            }
+
+            $this->execution->update([
+                'status' => 'success',
+                'message' => $warning,
+                'size' => $size,
+                'filename' => $backupLocation,
+                's3_uploaded' => $s3Uploaded,
+                's3_cleanup_pending' => $s3CleanupPending,
+                'local_storage_deleted' => $localStorageDeleted,
+            ]);
+
+            try {
+                $this->removeExpiredBackups($server);
+            } catch (Throwable $exception) {
+                Log::channel('scheduled-errors')->warning('Volume backup retention cleanup failed', [
+                    'backup_id' => $this->backup->id,
+                    'execution_id' => $this->execution->id,
+                    'error' => $exception->getMessage(),
+                ]);
+            }
+        } catch (Throwable $exception) {
+            $recoveryError = $this->recoverIncompleteBackup($this->execution);
+            $archiveDeleted = false;
+
+            try {
+                deleteBackupsLocally($backupLocation, $server, throwError: true);
+                $archiveDeleted = true;
+            } catch (Throwable $cleanupException) {
+                $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+            }
+
+            $s3CleanupPending = $this->execution->fresh()->s3_cleanup_pending;
+
+            $this->execution->update([
+                'status' => 'failed',
+                'message' => $exception->getMessage().$recoveryError,
+                'filename' => $archiveDeleted && ! $s3CleanupPending ? null : $backupLocation,
+                'local_storage_deleted' => $archiveDeleted,
+            ]);
+
+            throw $exception;
+        } finally {
+            $this->execution->update(['finished_at' => now()]);
+            BackupCreated::dispatch($team->id);
+        }
+    }
+
+    public function failed(?Throwable $exception): void
+    {
+        $execution = $this->execution ?? $this->backup->executions()
+            ->where('status', 'running')
+            ->latest('id')
+            ->first();
+
+        if ($execution) {
+            $recoveryError = $this->recoverIncompleteBackup($execution);
+            $server = $this->backup->server();
+            $filename = $execution->filename;
+            $localStorageDeleted = $execution->local_storage_deleted;
+
+            if ($server && filled($filename)) {
+                try {
+                    deleteBackupsLocally($filename, $server, throwError: true);
+                    $localStorageDeleted = true;
+                    if (! $execution->fresh()->s3_cleanup_pending) {
+                        $filename = null;
+                    }
+                } catch (Throwable $cleanupException) {
+                    $recoveryError .= ' Archive cleanup failed: '.$cleanupException->getMessage();
+                }
+            }
+
+            $execution->update([
+                'status' => 'failed',
+                'message' => ($exception?->getMessage() ?? 'Volume backup timed out or was terminated.').$recoveryError,
+                'finished_at' => now(),
+                'filename' => $filename,
+                'local_storage_deleted' => $localStorageDeleted,
+            ]);
+        }
+    }
+
+    /**
+     * @return array<int, string>
+     */
+    private function containersUsingVolume(string $source, Server $server): array
+    {
+        $output = instant_remote_process(
+            ["containers=\$(docker ps -q) || exit 1; for container in \$containers; do paused=\$(docker inspect --format '{{.State.Paused}}' \"\$container\") || exit 1; [ \"\$paused\" = true ] && continue; mounts=\$(docker inspect --format '{{range .Mounts}}{{println .Source}}{{println .Name}}{{end}}' \"\$container\") || exit 1; if printf '%s\\n' \"\$mounts\" | grep -Fqx -- ".escapeshellarg($source).'; then echo "$container"; fi; done'],
+            $server,
+            disableMultiplexing: true,
+        );
+        $containers = collect(preg_split('/\s+/', trim((string) $output)))
+            ->filter(fn (string $container): bool => preg_match('/^[a-f0-9]{6,64}$/i', $container) === 1)
+            ->values()
+            ->all();
+
+        return $containers;
+    }
+
+    /**
+     * @param  array<int, string>  $containers
+     */
+    private function archiveWithStoppedContainers(string $archiveCommand, array $containers, string $stateFile): string
+    {
+        if ($containers === []) {
+            return $archiveCommand;
+        }
+
+        $containerList = implode(' ', $containers);
+        $script = "set -eu\n"
+            .'state_file='.escapeshellarg($stateFile)."\n"
+            .": > \"\$state_file\"\n"
+            ."cleanup() { status=\$?; trap - EXIT HUP INT TERM; while IFS= read -r container; do docker start \"\$container\" >/dev/null || status=1; done < \"\$state_file\"; [ \$status -eq 0 ] && rm -f \"\$state_file\"; exit \$status; }\n"
+            ."trap cleanup EXIT\n"
+            ."trap 'exit 129' HUP\n"
+            ."trap 'exit 130' INT\n"
+            ."trap 'exit 143' TERM\n"
+            ."for container in {$containerList}; do echo \"\$container\" >> \"\$state_file\"; docker stop \"\$container\" >/dev/null; done\n"
+            .$archiveCommand;
+
+        return 'sh -c '.escapeshellarg($script);
+    }
+
+    private function recoverIncompleteBackup(ScheduledVolumeBackupExecution $execution): string
+    {
+        if (! $execution->stop_recovery_pending && ! $execution->s3_cleanup_pending) {
+            return '';
+        }
+
+        try {
+            VolumeBackupRecoveryJob::recover($execution);
+
+            return '';
+        } catch (Throwable $exception) {
+            VolumeBackupRecoveryJob::dispatch($execution);
+
+            return ' Container recovery failed: '.$exception->getMessage();
+        }
+    }
+
+    private function uploadToS3(string $backupLocation, string $backupDirectory, Server $server): void
+    {
+        $s3 = $this->backup->s3;
+
+        if (! $s3) {
+            $this->backup->update(['save_s3' => false, 's3_storage_id' => null]);
+
+            throw new \RuntimeException('The selected S3 storage no longer exists. S3 backup has been disabled.');
+        }
+
+        $s3->testConnection(shouldSave: true);
+        $containerName = 'volume-upload-'.$this->execution->uuid;
+        $image = coolifyHelperImage().':'.getHelperVersion();
+        $resolveOptions = collect(SafeWebhookUrl::minioClientResolveOptions($s3->endpoint))
+            ->map(fn (string $option): string => '--resolve '.escapeshellarg($option))
+            ->implode(' ');
+        $resolveOptions = $resolveOptions === '' ? '' : ' '.$resolveOptions;
+
+        try {
+            instant_remote_process([
+                'docker rm -f '.escapeshellarg($containerName).' >/dev/null 2>&1 || true',
+                'docker run -d --name '.escapeshellarg($containerName).' --rm -v '
+                    .escapeshellarg($backupLocation.':'.$backupLocation.':ro').' '.escapeshellarg($image),
+                'docker exec '.escapeshellarg($containerName).' mc alias set'.$resolveOptions.' temporary '
+                    .escapeshellarg($s3->endpoint).' '.escapeshellarg($s3->key).' '.escapeshellarg($s3->secret),
+                'docker exec '.escapeshellarg($containerName).' mc cp '.escapeshellarg($backupLocation).' '
+                    .escapeshellarg('temporary/'.$s3->bucket.$backupDirectory.'/'),
+            ], $server, timeout: $this->timeout, disableMultiplexing: true);
+        } finally {
+            instant_remote_process(
+                ['docker rm -f '.escapeshellarg($containerName)],
+                $server,
+                throwError: false,
+                disableMultiplexing: true,
+            );
+        }
+    }
+
+    private function removeExpiredBackups(Server $server): void
+    {
+        if ($this->hasRetentionLimits(
+            $this->backup->retention_amount_locally,
+            $this->backup->retention_days_locally,
+            $this->backup->retention_max_storage_locally,
+        )) {
+            $localExecutions = $this->backup->executions()
+                ->where('status', 'success')
+                ->where('local_storage_deleted', false)
+                ->get();
+            $localExecutions = $this->executionsOutsideRetention(
+                $localExecutions,
+                $this->backup->retention_amount_locally,
+                $this->backup->retention_days_locally,
+                $this->backup->retention_max_storage_locally,
+            );
+
+            $filenames = $localExecutions->pluck('filename')->filter()->all();
+            if ($filenames !== []) {
+                deleteBackupsLocally($filenames, $server, throwError: true);
+                $this->backup->executions()->whereKey($localExecutions->pluck('id')->all())
+                    ->update(['local_storage_deleted' => true]);
+            }
+        }
+
+        if ($this->backup->save_s3 && $this->backup->s3 && $this->hasRetentionLimits(
+            $this->backup->retention_amount_s3,
+            $this->backup->retention_days_s3,
+            $this->backup->retention_max_storage_s3,
+        )) {
+            $s3Executions = $this->backup->executions()
+                ->with('s3')
+                ->where('status', 'success')
+                ->where('s3_uploaded', true)
+                ->where('s3_storage_deleted', false)
+                ->get();
+            $s3Executions = $this->executionsOutsideRetention(
+                $s3Executions,
+                $this->backup->retention_amount_s3,
+                $this->backup->retention_days_s3,
+                $this->backup->retention_max_storage_s3,
+            );
+
+            foreach ($s3Executions->groupBy('s3_storage_id') as $executions) {
+                $s3 = $executions->first()->s3;
+                if (! $s3) {
+                    throw new \RuntimeException('The S3 storage used by an existing backup is unavailable.');
+                }
+
+                $filenames = $executions->pluck('filename')->filter()->all();
+                if ($filenames !== []) {
+                    deleteBackupsS3($filenames, $s3);
+                    $this->backup->executions()->whereKey($executions->pluck('id')->all())
+                        ->update(['s3_storage_deleted' => true]);
+                }
+            }
+        }
+
+        $this->backup->executions()
+            ->where('local_storage_deleted', true)
+            ->where(function (Builder $query): void {
+                $query->where('s3_storage_deleted', true)->orWhereNull('s3_uploaded');
+            })
+            ->delete();
+    }
+
+    private function hasRetentionLimits(int $amount, int $days, float $maxStorageGb): bool
+    {
+        return $amount > 0 || $days > 0 || $maxStorageGb > 0;
+    }
+
+    private function executionsOutsideRetention(Collection $executions, int $amount, int $days, float $maxStorageGb): Collection
+    {
+        if ($amount === 0 && $days === 0 && $maxStorageGb == 0) {
+            return collect();
+        }
+
+        $executionsToDelete = collect();
+
+        if ($amount > 0) {
+            $executionsToDelete = $executionsToDelete->merge($executions->skip($amount));
+        }
+
+        if ($days > 0) {
+            $oldestAllowedDate = now()->subDays($days);
+            $executionsToDelete = $executionsToDelete->merge(
+                $executions->filter(fn (ScheduledVolumeBackupExecution $execution): bool => $execution->created_at->isBefore($oldestAllowedDate)),
+            );
+        }
+
+        if ($maxStorageGb > 0) {
+            $maxStorageBytes = $maxStorageGb * 1024 ** 3;
+            $totalSize = 0;
+
+            foreach ($executions as $index => $execution) {
+                $totalSize += (int) $execution->size;
+
+                if ($index > 0 && $totalSize > $maxStorageBytes) {
+                    $executionsToDelete = $executionsToDelete->merge($executions->slice($index));
+
+                    break;
+                }
+            }
+        }
+
+        return $executionsToDelete->unique('id')->values();
+    }
+}

app/Jobs/VolumeBackupRecoveryJob.php

@@ -0,0 +1,117 @@
+<?php
+
+namespace App\Jobs;
+
+use App\Models\ScheduledVolumeBackupExecution;
+use Illuminate\Bus\Queueable;
+use Illuminate\Contracts\Queue\ShouldBeEncrypted;
+use Illuminate\Contracts\Queue\ShouldQueue;
+use Illuminate\Foundation\Bus\Dispatchable;
+use Illuminate\Queue\InteractsWithQueue;
+use Illuminate\Queue\Middleware\WithoutOverlapping;
+use Illuminate\Queue\SerializesModels;
+
+class VolumeBackupRecoveryJob implements ShouldBeEncrypted, ShouldQueue
+{
+    use Dispatchable, InteractsWithQueue, Queueable, SerializesModels;
+
+    public int $tries = 20;
+
+    public int $backoff = 60;
+
+    public int $timeout = 120;
+
+    public function __construct(public ScheduledVolumeBackupExecution $execution)
+    {
+        $this->onQueue(crons_queue());
+    }
+
+    public function middleware(): array
+    {
+        return [
+            (new WithoutOverlapping('volume-backup-'.$this->execution->scheduled_volume_backup_id))
+                ->shared()
+                ->expireAfter(300)
+                ->dontRelease(),
+            (new WithoutOverlapping('volume-backup-recovery-'.$this->execution->id))
+                ->expireAfter(300)
+                ->dontRelease(),
+        ];
+    }
+
+    public function handle(): void
+    {
+        self::recover($this->execution);
+    }
+
+    public static function recover(ScheduledVolumeBackupExecution $execution): void
+    {
+        $execution->loadMissing('scheduledVolumeBackup.backupable.resource');
+
+        if ($execution->stop_recovery_pending) {
+            self::recoverContainers($execution);
+        }
+
+        if ($execution->s3_cleanup_pending) {
+            self::cleanupS3Upload($execution);
+        }
+    }
+
+    private static function recoverContainers(ScheduledVolumeBackupExecution $execution): void
+    {
+        $server = $execution->scheduledVolumeBackup?->server();
+
+        if (! $server) {
+            throw new \RuntimeException('The server is unavailable for container recovery.');
+        }
+
+        $stateFile = self::stateFile($execution);
+        $output = instant_remote_process(
+            ['cat '.escapeshellarg($stateFile).' 2>/dev/null || true'],
+            $server,
+            disableMultiplexing: true,
+        );
+        $containers = collect(preg_split('/\s+/', trim((string) $output)))
+            ->filter(fn (string $container): bool => preg_match('/^[a-f0-9]{6,64}$/i', $container) === 1)
+            ->values()
+            ->all();
+        $execution->update(['stop_container_ids' => $containers]);
+
+        $remainingFile = $stateFile.'.remaining';
+        $script = 'status=0; : > '.escapeshellarg($remainingFile).'; '
+            .'if [ -f '.escapeshellarg($stateFile).' ]; then while IFS= read -r container; do '
+            .'[ -z "$container" ] && continue; running=$(docker inspect --format \'{{.State.Running}}\' "$container" 2>/dev/null) '
+            .'|| { echo "$container" >> '.escapeshellarg($remainingFile).'; status=1; continue; }; '
+            .'if [ "$running" != true ] && ! docker start "$container" >/dev/null; then echo "$container" >> '
+            .escapeshellarg($remainingFile).'; status=1; fi; done < '.escapeshellarg($stateFile).'; fi; '
+            .'if [ -s '.escapeshellarg($remainingFile).' ]; then mv '.escapeshellarg($remainingFile).' '.escapeshellarg($stateFile)
+            .'; else rm -f '.escapeshellarg($stateFile).' '.escapeshellarg($remainingFile).'; fi; exit $status';
+
+        instant_remote_process(['sh -c '.escapeshellarg($script)], $server, disableMultiplexing: true);
+        $execution->update([
+            'stop_container_ids' => null,
+            'stop_recovery_pending' => false,
+        ]);
+    }
+
+    public static function cleanupS3Upload(ScheduledVolumeBackupExecution $execution): void
+    {
+        $execution->loadMissing('s3');
+        $s3 = $execution->s3;
+
+        if (! $s3 || blank($execution->filename)) {
+            throw new \RuntimeException('The S3 storage or backup filename is unavailable for upload cleanup.');
+        }
+
+        deleteBackupsS3($execution->filename, $s3);
+        $execution->update([
+            's3_cleanup_pending' => false,
+            's3_storage_deleted' => true,
+        ]);
+    }
+
+    public static function stateFile(ScheduledVolumeBackupExecution $execution): string
+    {
+        return '/tmp/coolify-volume-backup-'.$execution->uuid.'.stopped';
+    }
+}

app/Livewire/Project/Application/Backup/Create.php

@@ -0,0 +1,145 @@
+<?php
+
+namespace App\Livewire\Project\Application\Backup;
+
+use App\Models\Application;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Support\Collection;
+use Livewire\Attributes\Locked;
+use Livewire\Component;
+
+class Create extends Component
+{
+    use AuthorizesRequests;
+
+    #[Locked]
+    public Application $application;
+
+    public ?string $selectedTargetKey = null;
+
+    public ?string $targetKey = null;
+
+    public bool $targetLocked = false;
+
+    public string $frequency = 'daily';
+
+    public Collection $targets;
+
+    protected function rules(): array
+    {
+        return [
+            'targetKey' => ['required', 'string', 'regex:/^(volume|directory):[1-9][0-9]*$/'],
+            'frequency' => ['required', 'string'],
+        ];
+    }
+
+    public function mount(): void
+    {
+        $this->authorize('view', $this->application);
+        $volumes = $this->application->persistentStorages()
+            ->orderBy('name')
+            ->get()
+            ->map(fn (LocalPersistentVolume $volume): array => [
+                'key' => 'volume:'.$volume->id,
+                'type' => 'Volume',
+                'name' => $volume->name,
+            ]);
+        $directories = $this->application->fileStorages()
+            ->where('is_directory', true)
+            ->where('is_host_file', false)
+            ->orderBy('fs_path')
+            ->get()
+            ->map(fn (LocalFileVolume $directory): array => [
+                'key' => 'directory:'.$directory->id,
+                'type' => 'Directory',
+                'name' => $directory->fs_path,
+            ]);
+        $this->targets = $volumes->concat($directories)->values();
+        $this->targetLocked = $this->selectedTargetKey !== null;
+        $this->targetKey = $this->selectedTargetKey ?? data_get($this->targets->first(), 'key');
+        $this->loadSelectedBackup();
+    }
+
+    public function updatedTargetKey(): void
+    {
+        $this->loadSelectedBackup();
+    }
+
+    public function submit(): void
+    {
+        $this->authorize('update', $this->application);
+        $this->validate();
+
+        $target = $this->selectedTarget();
+        if (! $target) {
+            $this->addError('targetKey', 'Select a volume or directory owned by this application.');
+
+            return;
+        }
+
+        if (! validate_cron_expression($this->frequency)) {
+            $this->addError('frequency', 'The frequency must be a valid cron or human expression.');
+
+            return;
+        }
+
+        try {
+            $backup = $target->scheduledBackups()->updateOrCreate(
+                [],
+                [
+                    'team_id' => currentTeam()->id,
+                    'frequency' => $this->frequency,
+                    'enabled' => true,
+                ],
+            );
+
+            $this->dispatch('success', $backup->wasRecentlyCreated ? 'Scheduled storage backup created.' : 'Scheduled storage backup updated.');
+            redirectRoute($this, 'project.application.backup.show', [
+                'project_uuid' => $this->application->project()->uuid,
+                'environment_uuid' => $this->application->environment->uuid,
+                'application_uuid' => $this->application->uuid,
+                'backup_uuid' => $backup->uuid,
+            ]);
+        } catch (\Throwable $e) {
+            handleError($e, $this);
+        }
+    }
+
+    public function render()
+    {
+        return view('livewire.project.application.backup.create');
+    }
+
+    private function loadSelectedBackup(): void
+    {
+        $target = $this->selectedTarget();
+        if (! $target) {
+            return;
+        }
+
+        $backup = $target->scheduledBackups()->first();
+        if ($backup) {
+            $this->frequency = $backup->frequency;
+        }
+    }
+
+    private function selectedTarget(): LocalPersistentVolume|LocalFileVolume|null
+    {
+        [$type, $id] = array_pad(explode(':', (string) $this->targetKey, 2), 2, null);
+        if (! ctype_digit((string) $id)) {
+            return null;
+        }
+
+        return match ($type) {
+            'volume' => $this->application->persistentStorages()->whereKey((int) $id)->first(),
+            'directory' => $this->application->fileStorages()
+                ->whereKey((int) $id)
+                ->where('is_directory', true)
+                ->where('is_host_file', false)
+                ->first(),
+            default => null,
+        };
+    }
+}

app/Livewire/Project/Application/Backup/Index.php

@@ -0,0 +1,57 @@
+<?php
+
+namespace App\Livewire\Project\Application\Backup;
+
+use App\Models\Application;
+use App\Models\ScheduledVolumeBackup;
+use Illuminate\Contracts\View\View;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class Index extends Component
+{
+    use AuthorizesRequests;
+
+    public Application $application;
+
+    public array $parameters;
+
+    public string $search = '';
+
+    protected $listeners = ['refreshVolumeBackups' => '$refresh'];
+
+    public function mount(): void
+    {
+        $this->application = $this->findApplication();
+        $this->authorize('view', $this->application);
+        $this->parameters = get_route_parameters();
+        $this->search = request()->string('search')->toString();
+    }
+
+    public function render(): View
+    {
+        $backups = ScheduledVolumeBackup::query()
+            ->with(['backupable', 'latestExecution'])
+            ->withCount('executions')
+            ->forApplication($this->application)
+            ->latest()
+            ->get();
+
+        return view('livewire.project.application.backup.index', ['backups' => $backups]);
+    }
+
+    private function findApplication(): Application
+    {
+        $project = currentTeam()->projects()
+            ->where('uuid', request()->route('project_uuid'))
+            ->firstOrFail();
+        $environment = $project->environments()
+            ->where('uuid', request()->route('environment_uuid'))
+            ->firstOrFail();
+
+        return $environment->applications()
+            ->with('destination.server')
+            ->where('uuid', request()->route('application_uuid'))
+            ->firstOrFail();
+    }
+}

app/Livewire/Project/Application/Backup/Show.php

@@ -0,0 +1,55 @@
+<?php
+
+namespace App\Livewire\Project\Application\Backup;
+
+use App\Models\Application;
+use App\Models\ScheduledVolumeBackup;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Component;
+
+class Show extends Component
+{
+    use AuthorizesRequests;
+
+    public Application $application;
+
+    public ScheduledVolumeBackup $backup;
+
+    public array $parameters;
+
+    public string $section = 'general';
+
+    public function mount(): void
+    {
+        $project = currentTeam()->projects()
+            ->where('uuid', request()->route('project_uuid'))
+            ->firstOrFail();
+        $environment = $project->environments()
+            ->where('uuid', request()->route('environment_uuid'))
+            ->firstOrFail();
+        $this->application = $environment->applications()
+            ->with('destination.server')
+            ->where('uuid', request()->route('application_uuid'))
+            ->firstOrFail();
+        $this->authorize('view', $this->application);
+
+        $this->backup = ScheduledVolumeBackup::query()
+            ->with('backupable')
+            ->where('uuid', request()->route('backup_uuid'))
+            ->forApplication($this->application)
+            ->firstOrFail();
+        $this->parameters = get_route_parameters();
+        $this->section = match (request()->route()?->getName()) {
+            'project.application.backup.s3' => 's3',
+            'project.application.backup.retention' => 'retention',
+            'project.application.backup.executions' => 'executions',
+            'project.application.backup.danger' => 'danger',
+            default => 'general',
+        };
+    }
+
+    public function render()
+    {
+        return view('livewire.project.application.backup.show');
+    }
+}

app/Livewire/Project/Database/Backup/Execution.php

@@ -15,6 +15,10 @@ class Execution extends Component
 
     public $s3s;
 
+    public array $parameters = [];
+
+    public string $section = 'general';
+
     public function mount()
     {
         $backup_uuid = request()->route('backup_uuid');
@@ -39,6 +43,14 @@ class Execution extends Component
         $this->backup = $backup;
         $this->executions = $executions;
         $this->s3s = currentTeam()->s3s;
+        $this->parameters = get_route_parameters();
+        $this->section = match (request()->route()?->getName()) {
+            'project.database.backup.s3' => 's3',
+            'project.database.backup.retention' => 'retention',
+            'project.database.backup.executions' => 'executions',
+            'project.database.backup.danger' => 'danger',
+            default => 'general',
+        };
     }
 
     public function render()

app/Livewire/Project/Database/BackupEdit.php

@@ -9,6 +9,7 @@ use App\Models\ServiceDatabase;
 use Exception;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Illuminate\Support\Collection;
+use Illuminate\Support\Facades\Auth;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -19,6 +20,8 @@ class BackupEdit extends Component
 
     public ScheduledDatabaseBackup $backup;
 
+    public string $section = 'general';
+
     #[Locked]
     public $availableS3Storages;
 
@@ -82,17 +85,49 @@ class BackupEdit extends Component
     #[Validate(['required', 'int', 'min:60', 'max:36000'])]
     public int|string $timeout = 3600;
 
+    public function getListeners(): array
+    {
+        // Keep "Backup Now" in sync when the database starts/stops without a full page refresh.
+        $listeners = ['databaseUpdated' => 'refreshStatus'];
+
+        $user = Auth::user();
+        if (! $user) {
+            return $listeners;
+        }
+
+        $listeners["echo-private:user.{$user->id},DatabaseStatusChanged"] = 'refreshStatus';
+
+        $team = $user->currentTeam();
+        if ($team) {
+            $listeners["echo-private:team.{$team->id},ServiceChecked"] = 'refreshStatus';
+        }
+
+        return $listeners;
+    }
+
     public function mount()
     {
         try {
             $this->authorize('view', $this->backup->database);
             $this->parameters = get_route_parameters();
             $this->syncData();
+            $this->refreshStatus();
         } catch (Exception $e) {
             return handleError($e, $this);
         }
     }
 
+    public function refreshStatus(): void
+    {
+        $database = $this->backup->database;
+        if (! $database) {
+            return;
+        }
+
+        $database->refresh();
+        $this->status = $database->status;
+    }
+
     public function syncData(bool $toModel = false)
     {
         if ($toModel) {
@@ -184,7 +219,11 @@ class BackupEdit extends Component
                     'stack_service_uuid' => $serviceDatabase->uuid,
                 ]);
             } else {
-                return redirect()->route('project.database.backup.index', $this->parameters);
+                return redirect()->route('project.database.backup.index', [
+                    'project_uuid' => $this->parameters['project_uuid'],
+                    'environment_uuid' => $this->parameters['environment_uuid'],
+                    'database_uuid' => $this->parameters['database_uuid'],
+                ]);
             }
         } catch (Exception $e) {
             $this->dispatch('error', 'Failed to delete backup: '.$e->getMessage());
@@ -200,6 +239,25 @@ class BackupEdit extends Component
 
             DatabaseBackupJob::dispatch($this->backup);
             $this->dispatch('success', 'Backup queued. It will be available in a few minutes.');
+
+            $database = $this->backup->database;
+
+            if ($database instanceof ServiceDatabase) {
+                return redirect()->route('project.service.database.backup.executions', [
+                    'project_uuid' => $database->service->project()->uuid,
+                    'environment_uuid' => $database->service->environment->uuid,
+                    'service_uuid' => $database->service->uuid,
+                    'stack_service_uuid' => $database->uuid,
+                    'backup_uuid' => $this->backup->uuid,
+                ]);
+            }
+
+            return redirect()->route('project.database.backup.executions', [
+                'project_uuid' => $database->project()->uuid,
+                'environment_uuid' => $database->environment->uuid,
+                'database_uuid' => $database->uuid,
+                'backup_uuid' => $this->backup->uuid,
+            ]);
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -217,11 +275,37 @@ class BackupEdit extends Component
         }
     }
 
+    public function toggleEnabled(): void
+    {
+        try {
+            $this->authorize('manageBackups', $this->backup->database);
+
+            $this->backupEnabled = ! $this->backupEnabled;
+            $this->backup->update(['enabled' => $this->backupEnabled]);
+            $this->dispatch('success', $this->backupEnabled ? 'Backup enabled.' : 'Backup disabled.');
+        } catch (\Throwable $e) {
+            $this->dispatch('error', $e->getMessage());
+        }
+    }
+
     public function updatedS3StorageId(): void
     {
         $this->instantSave();
     }
 
+    public function toggleS3(): void
+    {
+        if (! $this->saveS3 && $this->availableS3StorageIds()->isEmpty()) {
+            $this->dispatch('error', 'Select a usable S3 storage before enabling S3 backups.');
+
+            return;
+        }
+
+        $this->saveS3 = ! $this->saveS3;
+        $this->disableLocalBackup = $this->saveS3 && $this->disableLocalBackup;
+        $this->instantSave();
+    }
+
     private function customValidate()
     {
         if (! is_numeric($this->backup->s3_storage_id)) {

app/Livewire/Project/Database/CreateScheduledBackup.php

@@ -2,11 +2,9 @@
 
 namespace App\Livewire\Project\Database;
 
-use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
-use Illuminate\Support\Collection;
 use Livewire\Attributes\Locked;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
@@ -18,31 +16,11 @@ class CreateScheduledBackup extends Component
     #[Validate(['required', 'string'])]
     public $frequency;
 
-    #[Validate(['required', 'boolean'])]
-    public bool $saveToS3 = false;
-
     #[Locked]
     public $database;
 
     public bool $enabled = true;
 
-    #[Validate(['nullable', 'integer'])]
-    public ?int $s3StorageId = null;
-
-    public Collection $definedS3s;
-
-    public function mount()
-    {
-        try {
-            $this->definedS3s = currentTeam()->s3s;
-            if ($this->definedS3s->count() > 0) {
-                $this->s3StorageId = $this->definedS3s->first()->id;
-            }
-        } catch (\Throwable $e) {
-            return handleError($e, $this);
-        }
-    }
-
     public function submit()
     {
         try {
@@ -56,20 +34,6 @@ class CreateScheduledBackup extends Component
 
             $this->validate();
 
-            if ($this->saveToS3) {
-                $s3StorageExists = ! is_null($this->s3StorageId)
-                    && S3Storage::where('team_id', currentTeam()->id)
-                        ->where('is_usable', true)
-                        ->whereKey($this->s3StorageId)
-                        ->exists();
-
-                if (! $s3StorageExists) {
-                    $this->dispatch('error', 'Please select a valid S3 storage to enable S3 backups.');
-
-                    return;
-                }
-            }
-
             $isValid = validate_cron_expression($this->frequency);
             if (! $isValid) {
                 $this->dispatch('error', 'Invalid Cron / Human expression.');
@@ -80,8 +44,8 @@ class CreateScheduledBackup extends Component
             $payload = [
                 'enabled' => true,
                 'frequency' => $this->frequency,
-                'save_s3' => $this->saveToS3,
-                's3_storage_id' => $this->s3StorageId,
+                'save_s3' => false,
+                's3_storage_id' => null,
                 'database_id' => $this->database->id,
                 'database_type' => $this->database->getMorphClass(),
                 'team_id' => currentTeam()->id,
@@ -99,11 +63,22 @@ class CreateScheduledBackup extends Component
 
             $databaseBackup = ScheduledDatabaseBackup::create($payload);
             if ($this->database->getMorphClass() === ServiceDatabase::class) {
-                $this->dispatch('refreshScheduledBackups', $databaseBackup->id);
+                $service = $this->database->service;
+                $this->redirectRoute('project.service.database.backup.show', [
+                    'project_uuid' => $service->project()->uuid,
+                    'environment_uuid' => $service->environment->uuid,
+                    'service_uuid' => $service->uuid,
+                    'stack_service_uuid' => $this->database->uuid,
+                    'backup_uuid' => $databaseBackup->uuid,
+                ], navigate: true);
             } else {
-                $this->dispatch('refreshScheduledBackups');
+                $this->redirectRoute('project.database.backup.execution', [
+                    'project_uuid' => $this->database->project()->uuid,
+                    'environment_uuid' => $this->database->environment->uuid,
+                    'database_uuid' => $this->database->uuid,
+                    'backup_uuid' => $databaseBackup->uuid,
+                ], navigate: true);
             }
-
         } catch (\Throwable $e) {
             return handleError($e, $this);
         } finally {

app/Livewire/Project/Database/ScheduledBackups.php

@@ -2,8 +2,8 @@
 
 namespace App\Livewire\Project\Database;
 
-use App\Models\ScheduledDatabaseBackup;
 use App\Models\ServiceDatabase;
+use Illuminate\Contracts\View\View;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
 
@@ -17,42 +17,18 @@ class ScheduledBackups extends Component
 
     public $type;
 
-    public ?ScheduledDatabaseBackup $selectedBackup;
-
-    public $selectedBackupId;
-
-    public $s3s;
-
     public string $custom_type = 'mysql';
 
     protected $listeners = ['refreshScheduledBackups'];
 
-    protected $queryString = ['selectedBackupId'];
-
     public function mount(): void
     {
-        if ($this->selectedBackupId) {
-            $this->setSelectedBackup($this->selectedBackupId, true);
-        }
         $this->parameters = get_route_parameters();
         if ($this->database->getMorphClass() === ServiceDatabase::class) {
             $this->type = 'service-database';
         } else {
             $this->type = 'database';
         }
-        $this->s3s = currentTeam()->s3s;
-    }
-
-    public function setSelectedBackup($backupId, $force = false)
-    {
-        if ($this->selectedBackupId === $backupId && ! $force) {
-            return;
-        }
-        $this->selectedBackupId = $backupId;
-        $this->selectedBackup = $this->database->scheduledBackups->find($backupId);
-        if (is_null($this->selectedBackup)) {
-            $this->selectedBackupId = null;
-        }
     }
 
     public function setCustomType()
@@ -86,9 +62,13 @@ class ScheduledBackups extends Component
     public function refreshScheduledBackups(?int $id = null): void
     {
         $this->database->refresh();
-        if ($id) {
-            $this->setSelectedBackup($id);
-        }
         $this->dispatch('refreshScheduledBackups');
     }
+
+    public function render(): View
+    {
+        $this->database->loadMissing('scheduledBackups.s3');
+
+        return view('livewire.project.database.scheduled-backups');
+    }
 }

app/Livewire/Project/Service/DatabaseBackups.php

@@ -2,6 +2,7 @@
 
 namespace App\Livewire\Project\Service;
 
+use App\Models\ScheduledDatabaseBackup;
 use App\Models\Service;
 use App\Models\ServiceDatabase;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
@@ -17,16 +18,28 @@ class DatabaseBackups extends Component
 
     public array $parameters;
 
+    public array $backupParameters = [];
+
     public array $query;
 
     public bool $isImportSupported = false;
 
+    public ?ScheduledDatabaseBackup $backup = null;
+
+    public string $section = 'index';
+
+    public $s3s;
+
     protected $listeners = ['refreshScheduledBackups' => '$refresh'];
 
     public function mount()
     {
         try {
-            $this->parameters = get_route_parameters();
+            $this->parameters = array_filter(
+                get_route_parameters(),
+                fn (string $key): bool => $key !== 'backup_uuid',
+                ARRAY_FILTER_USE_KEY,
+            );
             $this->query = request()->query();
             $project = currentTeam()
                 ->projects()
@@ -58,6 +71,21 @@ class DatabaseBackups extends Component
             $dbType = $this->serviceDatabase->databaseType();
             $supportedTypes = ['mysql', 'mariadb', 'postgres', 'mongo'];
             $this->isImportSupported = collect($supportedTypes)->contains(fn ($type) => str_contains($dbType, $type));
+
+            if (request()->route('backup_uuid')) {
+                $this->backup = $this->serviceDatabase->scheduledBackups()
+                    ->where('uuid', request()->route('backup_uuid'))
+                    ->firstOrFail();
+                $this->s3s = currentTeam()->s3s;
+                $this->backupParameters = [...$this->parameters, 'backup_uuid' => $this->backup->uuid];
+                $this->section = match (request()->route()?->getName()) {
+                    'project.service.database.backup.s3' => 's3',
+                    'project.service.database.backup.retention' => 'retention',
+                    'project.service.database.backup.executions' => 'executions',
+                    'project.service.database.backup.danger' => 'danger',
+                    default => 'general',
+                };
+            }
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }

app/Livewire/Project/Service/FileStorage.php

@@ -4,6 +4,7 @@ namespace App\Livewire\Project\Service;
 
 use App\Models\Application;
 use App\Models\LocalFileVolume;
+use App\Models\ScheduledVolumeBackup;
 use App\Models\ServiceApplication;
 use App\Models\ServiceDatabase;
 use App\Models\StandaloneClickhouse;
@@ -15,6 +16,7 @@ use App\Models\StandaloneMysql;
 use App\Models\StandalonePostgresql;
 use App\Models\StandaloneRedis;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\On;
 use Livewire\Attributes\Validate;
 use Livewire\Component;
 
@@ -34,6 +36,10 @@ class FileStorage extends Component
 
     public bool $isReadOnly = false;
 
+    public bool $hasEnabledBackup = false;
+
+    public ?string $backupUrl = null;
+
     #[Validate(['nullable'])]
     public ?string $content = null;
 
@@ -65,6 +71,53 @@ class FileStorage extends Component
 
         $this->isReadOnly = $this->fileStorage->shouldBeReadOnlyInUI() || $this->fileStorage->is_too_large;
         $this->syncData();
+        $this->refreshBackupStatus();
+    }
+
+    #[On('refreshVolumeBackups')]
+    public function refreshBackupStatus(): void
+    {
+        $backup = $this->fileStorage->is_directory
+            ? $this->fileStorage->scheduledBackups()->first()
+            : null;
+
+        $this->hasEnabledBackup = $backup?->enabled ?? false;
+        $this->backupUrl = null;
+
+        if (! $this->hasEnabledBackup) {
+            return;
+        }
+
+        if ($this->resource instanceof ServiceDatabase) {
+            $this->backupUrl = route('project.service.database.backups', [
+                'project_uuid' => $this->resource->service->project()->uuid,
+                'environment_uuid' => $this->resource->service->environment->uuid,
+                'service_uuid' => $this->resource->service->uuid,
+                'stack_service_uuid' => $this->resource->uuid,
+            ]);
+
+            return;
+        }
+
+        if (! $this->resource instanceof Application) {
+            $this->hasEnabledBackup = false;
+
+            return;
+        }
+
+        $parameters = [
+            'project_uuid' => $this->resource->project()->uuid,
+            'environment_uuid' => $this->resource->environment->uuid,
+            'application_uuid' => $this->resource->uuid,
+        ];
+        $hasOtherBackups = ScheduledVolumeBackup::query()
+            ->forApplication($this->resource)
+            ->where('id', '!=', $backup->id)
+            ->exists();
+
+        $this->backupUrl = $hasOtherBackups
+            ? route('project.application.backup.index', [...$parameters, 'search' => $this->fileStorage->fs_path])
+            : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
     }
 
     public function syncData(bool $toModel = false): void
@@ -135,6 +188,10 @@ class FileStorage extends Component
         try {
             $this->authorize('update', $this->resource);
 
+            if ($this->fileStorage->scheduledBackups()->exists()) {
+                throw new \RuntimeException('Delete this directory backup schedule and its archives before converting it to a file.');
+            }
+
             if ($this->fileStorage->is_host_file) {
                 throw new \Exception('Host file mounts are bind-only and cannot be converted.');
             }
@@ -162,6 +219,12 @@ class FileStorage extends Component
             return 'The provided password is incorrect.';
         }
 
+        if ($this->fileStorage->scheduledBackups()->exists()) {
+            $this->dispatch('error', 'Delete this directory backup schedule and its archives before deleting the directory.');
+
+            return false;
+        }
+
         try {
             $message = 'File deleted.';
             if ($this->fileStorage->is_directory) {
@@ -174,6 +237,7 @@ class FileStorage extends Component
                 $this->fileStorage->deleteStorageOnServer();
             }
             $this->fileStorage->delete();
+            $this->dispatch('configurationChanged');
             $this->dispatch('success', $message);
         } catch (\Throwable $e) {
             return handleError($e, $this);

app/Livewire/Project/Service/Storage.php

@@ -131,10 +131,12 @@ class Storage extends Component
                 'resource_type' => $this->resource->getMorphClass(),
             ]);
             $this->resource->refresh();
+            $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Volume added successfully');
             $this->dispatch('closeStorageModal', 'volume');
             $this->clearForm();
             $this->refreshStorages();
+            $this->dispatch('refreshStorages');
         } catch (\Throwable $e) {
             return handleError($e, $this);
         }
@@ -163,6 +165,7 @@ class Storage extends Component
                 'resource_type' => get_class($this->resource),
             ]);
 
+            $this->dispatch('configurationChanged');
             $this->dispatch('success', 'File mount added successfully');
             $this->dispatch('closeStorageModal', 'file');
             $this->clearForm();
@@ -195,6 +198,7 @@ class Storage extends Component
                 'resource_type' => get_class($this->resource),
             ]);
 
+            $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Host file mount added successfully');
             $this->dispatch('closeStorageModal', 'host-file');
             $this->clearForm();
@@ -231,6 +235,7 @@ class Storage extends Component
                 'resource_type' => get_class($this->resource),
             ]);
 
+            $this->dispatch('configurationChanged');
             $this->dispatch('success', 'Directory mount added successfully');
             $this->dispatch('closeStorageModal', 'directory');
             $this->clearForm();

app/Livewire/Project/Shared/Storages/Show.php

@@ -2,9 +2,12 @@
 
 namespace App\Livewire\Project\Shared\Storages;
 
+use App\Models\Application;
 use App\Models\LocalPersistentVolume;
+use App\Models\ScheduledVolumeBackup;
 use App\Support\ValidationPatterns;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Livewire\Attributes\On;
 use Livewire\Component;
 
 class Show extends Component
@@ -32,6 +35,10 @@ class Show extends Component
 
     public bool $isPreviewSuffixEnabled = true;
 
+    public bool $hasEnabledBackup = false;
+
+    public ?string $backupUrl = null;
+
     protected $validationAttributes = [
         'name' => 'name',
         'mountPath' => 'mount',
@@ -81,10 +88,38 @@ class Show extends Component
         }
     }
 
-    public function mount()
+    public function mount(): void
     {
         $this->syncData(false);
         $this->isReadOnly = $this->storage->shouldBeReadOnlyInUI();
+        $this->refreshBackupStatus();
+    }
+
+    #[On('refreshVolumeBackups')]
+    public function refreshBackupStatus(): void
+    {
+        $backup = $this->storage->scheduledBackups()->first();
+
+        $this->hasEnabledBackup = $backup?->enabled ?? false;
+        $this->backupUrl = null;
+
+        if (! $this->hasEnabledBackup || ! $this->resource instanceof Application) {
+            return;
+        }
+
+        $parameters = [
+            'project_uuid' => $this->resource->project()->uuid,
+            'environment_uuid' => $this->resource->environment->uuid,
+            'application_uuid' => $this->resource->uuid,
+        ];
+        $hasOtherBackups = ScheduledVolumeBackup::query()
+            ->forApplication($this->resource)
+            ->where('id', '!=', $backup->id)
+            ->exists();
+
+        $this->backupUrl = $hasOtherBackups
+            ? route('project.application.backup.index', [...$parameters, 'search' => $this->storage->name])
+            : route('project.application.backup.show', [...$parameters, 'backup_uuid' => $backup->uuid]);
     }
 
     public function instantSave(): void
@@ -115,8 +150,15 @@ class Show extends Component
             return 'The provided password is incorrect.';
         }
 
+        if ($this->storage->scheduledBackups()->exists()) {
+            $this->dispatch('error', 'Delete this volume backup schedule and its archives before deleting the volume.');
+
+            return false;
+        }
+
         $this->storage->delete();
         $this->dispatch('refreshStorages');
+        $this->dispatch('configurationChanged');
 
         return true;
     }

app/Livewire/Project/Shared/Storages/VolumeBackups.php

@@ -0,0 +1,388 @@
+<?php
+
+namespace App\Livewire\Project\Shared\Storages;
+
+use App\Actions\Shared\DeleteScheduledVolumeBackup;
+use App\Jobs\VolumeBackupJob;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
+use App\Models\S3Storage;
+use App\Models\ScheduledVolumeBackup;
+use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Routing\Redirector;
+use Illuminate\Support\Collection;
+use Livewire\Component;
+use Livewire\WithPagination;
+use Throwable;
+
+class VolumeBackups extends Component
+{
+    use AuthorizesRequests;
+    use WithPagination;
+
+    public LocalPersistentVolume|LocalFileVolume $storage;
+
+    public $resource;
+
+    public ?ScheduledVolumeBackup $backup = null;
+
+    public string $section = 'general';
+
+    public string $frequency = 'daily';
+
+    public bool $enabled = false;
+
+    public bool $saveToS3 = false;
+
+    public bool $disableLocalBackup = false;
+
+    public bool $stopDuringBackup = false;
+
+    public ?int $s3StorageId = null;
+
+    public int $retentionAmountLocally = 7;
+
+    public int $retentionDaysLocally = 0;
+
+    public float $retentionMaxStorageLocally = 0;
+
+    public int $retentionAmountS3 = 7;
+
+    public int $retentionDaysS3 = 0;
+
+    public float $retentionMaxStorageS3 = 0;
+
+    public string $timezone = '';
+
+    public int $timeout = 3600;
+
+    public bool $delete_backup_s3 = false;
+
+    public Collection $availableS3Storages;
+
+    protected function rules(): array
+    {
+        return [
+            'frequency' => ['required', 'string'],
+            'enabled' => ['required', 'boolean'],
+            'saveToS3' => ['required', 'boolean'],
+            'disableLocalBackup' => ['required', 'boolean'],
+            'stopDuringBackup' => ['required', 'boolean'],
+            's3StorageId' => ['nullable', 'integer'],
+            'retentionAmountLocally' => ['required', 'integer', 'min:0', 'max:10000'],
+            'retentionDaysLocally' => ['required', 'integer', 'min:0'],
+            'retentionMaxStorageLocally' => ['required', 'numeric', 'min:0'],
+            'retentionAmountS3' => ['required', 'integer', 'min:0', 'max:10000'],
+            'retentionDaysS3' => ['required', 'integer', 'min:0'],
+            'retentionMaxStorageS3' => ['required', 'numeric', 'min:0'],
+            'timeout' => ['required', 'integer', 'min:60', 'max:36000'],
+        ];
+    }
+
+    public function mount(): void
+    {
+        $this->authorize('view', $this->resource);
+        $this->availableS3Storages = S3Storage::ownedByCurrentTeam()
+            ->where('is_usable', true)
+            ->get();
+        $this->backup = $this->storage->scheduledBackups()->first();
+        $server = $this->backup?->server() ?? data_get($this->resource, 'destination.server');
+        $this->timezone = data_get($server, 'settings.server_timezone', 'Instance timezone');
+
+        if ($this->backup) {
+            $this->frequency = $this->backup->frequency;
+            $this->enabled = $this->backup->enabled;
+            $this->saveToS3 = $this->backup->save_s3;
+            $this->disableLocalBackup = $this->backup->disable_local_backup;
+            $this->stopDuringBackup = $this->backup->stop_during_backup;
+            $this->s3StorageId = $this->backup->s3_storage_id ?? $this->availableS3Storages->first()?->id;
+            $this->retentionAmountLocally = $this->backup->retention_amount_locally;
+            $this->retentionDaysLocally = $this->backup->retention_days_locally;
+            $this->retentionMaxStorageLocally = $this->backup->retention_max_storage_locally;
+            $this->retentionAmountS3 = $this->backup->retention_amount_s3;
+            $this->retentionDaysS3 = $this->backup->retention_days_s3;
+            $this->retentionMaxStorageS3 = $this->backup->retention_max_storage_s3;
+            $this->timeout = $this->backup->timeout;
+        } else {
+            $this->s3StorageId = $this->availableS3Storages->first()?->id;
+        }
+    }
+
+    public function save(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! $this->validateSettings()) {
+            return;
+        }
+
+        $this->backup = $this->persistBackup($this->enabled);
+        $this->dispatch('success', 'Storage backup schedule saved.');
+    }
+
+    public function instantSave(): void
+    {
+        $this->save();
+    }
+
+    public function updatedS3StorageId(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! $this->hasValidS3Storage()) {
+            $this->addError('s3StorageId', 'Select a usable S3 storage owned by your team.');
+
+            return;
+        }
+
+        $this->resetErrorBag('s3StorageId');
+        $this->backup?->update(['s3_storage_id' => $this->s3StorageId]);
+        $this->dispatch('success', 'S3 storage updated.');
+    }
+
+    public function toggleS3(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! $this->saveToS3 && ! $this->hasValidS3Storage()) {
+            $this->dispatch('error', 'Select a usable S3 storage before enabling S3 backups.');
+
+            return;
+        }
+
+        $this->saveToS3 = ! $this->saveToS3;
+        $this->disableLocalBackup = $this->saveToS3 && $this->disableLocalBackup;
+        $this->backup?->update([
+            'save_s3' => $this->saveToS3,
+            'disable_local_backup' => $this->disableLocalBackup,
+            's3_storage_id' => $this->s3StorageId,
+        ]);
+        $this->dispatch('success', $this->saveToS3 ? 'S3 backups enabled.' : 'S3 backups disabled.');
+    }
+
+    public function toggleEnabled(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! $this->backup) {
+            if (! $this->validateSettings()) {
+                return;
+            }
+
+            $this->enabled = true;
+            $this->backup = $this->persistBackup(true);
+        } else {
+            $this->enabled = ! $this->enabled;
+            $this->backup->update(['enabled' => $this->enabled]);
+        }
+
+        $this->dispatch('success', $this->enabled ? 'Storage backups enabled.' : 'Storage backups disabled.');
+    }
+
+    public function backupNow(): Redirector|RedirectResponse|null
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! $this->backup) {
+            if (! $this->validateSettings()) {
+                return null;
+            }
+
+            $this->enabled = false;
+            $this->backup = $this->persistBackup(false);
+        }
+
+        VolumeBackupJob::dispatch($this->backup);
+        $this->dispatch('success', 'Storage backup queued.');
+
+        return redirect()->route('project.application.backup.executions', [
+            'project_uuid' => $this->resource->project()->uuid,
+            'environment_uuid' => $this->resource->environment->uuid,
+            'application_uuid' => $this->resource->uuid,
+            'backup_uuid' => $this->backup->uuid,
+        ]);
+    }
+
+    public function delete(?string $password = null, array $selectedActions = []): bool|string
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! verifyPasswordConfirmation($password, $this)) {
+            return 'The provided password is incorrect.';
+        }
+
+        if (! $this->backup) {
+            return false;
+        }
+
+        try {
+            DeleteScheduledVolumeBackup::run($this->backup);
+            $this->backup = null;
+            $this->dispatch('success', 'Storage backup schedule and archives deleted.');
+            $this->redirectRoute('project.application.backup.index', [
+                'project_uuid' => $this->resource->project()->uuid,
+                'environment_uuid' => $this->resource->environment->uuid,
+                'application_uuid' => $this->resource->uuid,
+            ], navigate: true);
+
+            return true;
+        } catch (Throwable $exception) {
+            $this->dispatch('error', 'Could not delete the backup archives: '.$exception->getMessage());
+
+            return false;
+        }
+    }
+
+    public function cleanupFailed(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        $deletedCount = $this->backup?->executions()
+            ->where('status', 'failed')
+            ->where('stop_recovery_pending', false)
+            ->where('s3_cleanup_pending', false)
+            ->where(fn ($query) => $query
+                ->whereNull('filename')
+                ->orWhere('local_storage_deleted', true))
+            ->delete() ?? 0;
+
+        $this->dispatch(
+            $deletedCount > 0 ? 'success' : 'info',
+            $deletedCount > 0 ? 'Failed backup entries cleaned up.' : 'No safely removable failed backup entries found.',
+        );
+    }
+
+    public function cleanupDeleted(): void
+    {
+        $this->authorize('update', $this->resource);
+
+        $deletedCount = $this->backup?->executions()
+            ->where('local_storage_deleted', true)
+            ->where(fn ($query) => $query
+                ->where('s3_storage_deleted', true)
+                ->orWhereNull('s3_uploaded')
+                ->orWhere('s3_uploaded', false))
+            ->delete() ?? 0;
+
+        $this->dispatch(
+            $deletedCount > 0 ? 'success' : 'info',
+            $deletedCount > 0 ? "Cleaned up {$deletedCount} deleted backup entries." : 'No deleted backup entries found.',
+        );
+    }
+
+    public function deleteBackup(int $executionId, string $password, array $selectedActions = []): bool|string
+    {
+        $this->authorize('update', $this->resource);
+
+        if (! verifyPasswordConfirmation($password, $this)) {
+            return 'The provided password is incorrect.';
+        }
+
+        $execution = $this->backup?->executions()->whereKey($executionId)->first();
+        if (! $execution) {
+            $this->dispatch('error', 'Backup execution not found.');
+
+            return false;
+        }
+
+        if ($execution->status === 'running' || $execution->stop_recovery_pending || $execution->s3_cleanup_pending) {
+            $this->dispatch('error', 'Wait for the backup and recovery operations to finish before deleting it.');
+
+            return false;
+        }
+
+        try {
+            $server = $this->backup->server();
+            if (! $execution->local_storage_deleted && filled($execution->filename)) {
+                if (! $server) {
+                    throw new \RuntimeException('The server is unavailable.');
+                }
+
+                deleteBackupsLocally($execution->filename, $server, throwError: true);
+            }
+
+            if ($this->delete_backup_s3 && $execution->s3_uploaded && ! $execution->s3_storage_deleted) {
+                if (! $execution->s3) {
+                    throw new \RuntimeException('The S3 storage is unavailable.');
+                }
+
+                deleteBackupsS3($execution->filename, $execution->s3);
+            }
+
+            $execution->delete();
+            $this->delete_backup_s3 = false;
+            $this->dispatch('success', 'Backup deleted.');
+
+            return true;
+        } catch (Throwable $exception) {
+            $this->dispatch('error', 'Failed to delete backup: '.$exception->getMessage());
+
+            return false;
+        }
+    }
+
+    public function render()
+    {
+        $executions = $this->backup?->executions()->paginate(10);
+
+        return view('livewire.project.shared.storages.volume-backups', [
+            'executions' => $executions ?? collect(),
+            'latestExecution' => $this->backup?->executions()->first(),
+        ]);
+    }
+
+    private function validateSettings(): bool
+    {
+        $this->validate();
+
+        if (! validate_cron_expression($this->frequency)) {
+            $this->addError('frequency', 'The frequency must be a valid cron or human expression.');
+
+            return false;
+        }
+
+        if ($this->saveToS3 && ! $this->hasValidS3Storage()) {
+            $this->addError('s3StorageId', 'Select a usable S3 storage owned by your team.');
+
+            return false;
+        }
+
+        $this->disableLocalBackup = $this->saveToS3 && $this->disableLocalBackup;
+
+        return true;
+    }
+
+    private function persistBackup(bool $enabled): ScheduledVolumeBackup
+    {
+        return $this->storage->scheduledBackups()->updateOrCreate(
+            [],
+            [
+                'team_id' => currentTeam()->id,
+                'frequency' => $this->frequency,
+                'enabled' => $enabled,
+                'save_s3' => $this->saveToS3,
+                'disable_local_backup' => $this->disableLocalBackup,
+                'stop_during_backup' => $this->stopDuringBackup,
+                's3_storage_id' => $this->hasValidS3Storage() ? $this->s3StorageId : $this->backup?->s3_storage_id,
+                'retention_amount_locally' => $this->retentionAmountLocally,
+                'retention_days_locally' => $this->retentionDaysLocally,
+                'retention_max_storage_locally' => $this->retentionMaxStorageLocally,
+                'retention_amount_s3' => $this->retentionAmountS3,
+                'retention_days_s3' => $this->retentionDaysS3,
+                'retention_max_storage_s3' => $this->retentionMaxStorageS3,
+                'timeout' => $this->timeout,
+            ],
+        );
+    }
+
+    private function hasValidS3Storage(): bool
+    {
+        return $this->s3StorageId !== null
+            && S3Storage::query()
+                ->whereKey($this->s3StorageId)
+                ->where('team_id', currentTeam()->id)
+                ->where('is_usable', true)
+                ->exists();
+    }
+}

app/Livewire/Storage/Show.php

@@ -4,6 +4,7 @@ namespace App\Livewire\Storage;
 
 use App\Models\S3Storage;
 use App\Models\ScheduledDatabaseBackup;
+use App\Models\ScheduledVolumeBackup;
 use Illuminate\Auth\Access\AuthorizationException;
 use Illuminate\Foundation\Auth\Access\AuthorizesRequests;
 use Livewire\Component;
@@ -30,7 +31,8 @@ class Show extends Component
             return $this->redirectRoute('storage.index', navigate: true);
         }
         $this->currentRoute = request()->route()->getName();
-        $this->backupCount = ScheduledDatabaseBackup::where('s3_storage_id', $this->storage->id)->count();
+        $this->backupCount = ScheduledDatabaseBackup::where('s3_storage_id', $this->storage->id)->count()
+            + ScheduledVolumeBackup::where('s3_storage_id', $this->storage->id)->count();
     }
 
     public function delete()

app/Models/LocalFileVolume.php

@@ -6,6 +6,8 @@ use App\Events\FileStorageChanged;
 use App\Jobs\ServerStorageSaveJob;
 use Illuminate\Database\Eloquent\Casts\Attribute;
 use Illuminate\Database\Eloquent\Factories\HasFactory;
+use Illuminate\Database\Eloquent\Relations\MorphMany;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
 use Symfony\Component\Yaml\Yaml;
 
 class LocalFileVolume extends BaseModel
@@ -57,6 +59,12 @@ class LocalFileVolume extends BaseModel
             $fileVolume->load(['service']);
             dispatch(new ServerStorageSaveJob($fileVolume));
         });
+
+        static::deleting(function (LocalFileVolume $fileVolume): void {
+            if ($fileVolume->scheduledBackups()->exists()) {
+                throw new \RuntimeException('Delete this directory backup schedule and its archives before deleting the directory.');
+            }
+        });
     }
 
     protected function isBinary(): Attribute
@@ -73,11 +81,28 @@ class LocalFileVolume extends BaseModel
         );
     }
 
-    public function service()
+    public function resource(): MorphTo
+    {
+        return $this->morphTo();
+    }
+
+    public function service(): MorphTo
     {
         return $this->morphTo('resource');
     }
 
+    public function scheduledBackups(): MorphMany
+    {
+        return $this->morphMany(ScheduledVolumeBackup::class, 'backupable');
+    }
+
+    public function abortIfScheduledBackupsExist(): void
+    {
+        if ($this->scheduledBackups()->exists()) {
+            abort(422, 'Delete this directory backup schedule and its archives before deleting the directory.');
+        }
+    }
+
     public function loadStorageOnServer()
     {
         if ($this->is_host_file) {

app/Models/LocalPersistentVolume.php

@@ -3,10 +3,20 @@
 namespace App\Models;
 
 use Illuminate\Database\Eloquent\Casts\Attribute;
+use Illuminate\Database\Eloquent\Relations\MorphMany;
 use Symfony\Component\Yaml\Yaml;
 
 class LocalPersistentVolume extends BaseModel
 {
+    protected static function booted(): void
+    {
+        static::deleting(function (LocalPersistentVolume $volume): void {
+            if ($volume->scheduledBackups()->exists()) {
+                throw new \RuntimeException('Delete this volume backup schedule and its archives before deleting the volume.');
+            }
+        });
+    }
+
     protected $fillable = [
         'name',
         'mount_path',
@@ -41,6 +51,18 @@ class LocalPersistentVolume extends BaseModel
         return $this->morphTo('resource');
     }
 
+    public function scheduledBackups(): MorphMany
+    {
+        return $this->morphMany(ScheduledVolumeBackup::class, 'backupable');
+    }
+
+    public function abortIfScheduledBackupsExist(): void
+    {
+        if ($this->scheduledBackups()->exists()) {
+            abort(422, 'Delete this volume backup schedule and its archives before deleting the volume.');
+        }
+    }
+
     protected function customizeName($value)
     {
         return str($value)->trim()->value;

app/Models/S3Storage.php

@@ -69,6 +69,15 @@ class S3Storage extends BaseModel
                 'save_s3' => false,
                 's3_storage_id' => null,
             ]);
+            ScheduledVolumeBackupExecution::where('s3_storage_id', $storage->id)
+                ->update([
+                    's3_storage_deleted' => true,
+                    's3_cleanup_pending' => false,
+                ]);
+            ScheduledVolumeBackup::where('s3_storage_id', $storage->id)->update([
+                'save_s3' => false,
+                's3_storage_id' => null,
+            ]);
         });
     }
 
@@ -101,6 +110,11 @@ class S3Storage extends BaseModel
         return $this->hasMany(ScheduledDatabaseBackup::class, 's3_storage_id');
     }
 
+    public function scheduledVolumeBackups()
+    {
+        return $this->hasMany(ScheduledVolumeBackup::class, 's3_storage_id');
+    }
+
     public function awsUrl()
     {
         return "{$this->endpoint}/{$this->bucket}";

app/Models/ScheduledVolumeBackup.php

@@ -0,0 +1,149 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Builder;
+use Illuminate\Database\Eloquent\Model;
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+use Illuminate\Database\Eloquent\Relations\HasMany;
+use Illuminate\Database\Eloquent\Relations\HasOne;
+use Illuminate\Database\Eloquent\Relations\MorphTo;
+
+class ScheduledVolumeBackup extends BaseModel
+{
+    protected $fillable = [
+        'uuid',
+        'backupable_type',
+        'backupable_id',
+        'team_id',
+        's3_storage_id',
+        'frequency',
+        'enabled',
+        'save_s3',
+        'disable_local_backup',
+        'stop_during_backup',
+        'retention_amount_locally',
+        'retention_days_locally',
+        'retention_max_storage_locally',
+        'retention_amount_s3',
+        'retention_days_s3',
+        'retention_max_storage_s3',
+        'timeout',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'enabled' => 'boolean',
+            'save_s3' => 'boolean',
+            'disable_local_backup' => 'boolean',
+            'stop_during_backup' => 'boolean',
+            'retention_amount_locally' => 'integer',
+            'retention_days_locally' => 'integer',
+            'retention_max_storage_locally' => 'float',
+            'retention_amount_s3' => 'integer',
+            'retention_days_s3' => 'integer',
+            'retention_max_storage_s3' => 'float',
+            'timeout' => 'integer',
+        ];
+    }
+
+    public function scopeForApplication(Builder $query, Application $application): Builder
+    {
+        $volumeIds = $application->persistentStorages()->pluck('id');
+        $directoryIds = $application->fileStorages()
+            ->where('is_directory', true)
+            ->where('is_host_file', false)
+            ->pluck('id');
+
+        return $query->where(function (Builder $query) use ($volumeIds, $directoryIds): void {
+            $query->where(function (Builder $query) use ($volumeIds): void {
+                $query->where('backupable_type', (new LocalPersistentVolume)->getMorphClass())
+                    ->whereIn('backupable_id', $volumeIds);
+            })->orWhere(function (Builder $query) use ($directoryIds): void {
+                $query->where('backupable_type', (new LocalFileVolume)->getMorphClass())
+                    ->whereIn('backupable_id', $directoryIds);
+            });
+        });
+    }
+
+    public function backupable(): MorphTo
+    {
+        return $this->morphTo();
+    }
+
+    public function team(): BelongsTo
+    {
+        return $this->belongsTo(Team::class);
+    }
+
+    public function s3(): BelongsTo
+    {
+        return $this->belongsTo(S3Storage::class, 's3_storage_id');
+    }
+
+    public function executions(): HasMany
+    {
+        return $this->hasMany(ScheduledVolumeBackupExecution::class)->latest();
+    }
+
+    public function latestExecution(): HasOne
+    {
+        return $this->hasOne(ScheduledVolumeBackupExecution::class)->latestOfMany();
+    }
+
+    public function server(): ?Server
+    {
+        $resource = $this->targetResource();
+
+        if ($resource instanceof ServiceApplication || $resource instanceof ServiceDatabase) {
+            return $resource->service?->server?->fresh();
+        }
+
+        return $resource?->destination?->server?->fresh();
+    }
+
+    public function targetResource(): ?Model
+    {
+        return $this->backupable?->resource;
+    }
+
+    public function targetType(): string
+    {
+        return $this->backupable instanceof LocalFileVolume ? 'Directory' : 'Volume';
+    }
+
+    public function targetName(): string
+    {
+        return match (true) {
+            $this->backupable instanceof LocalFileVolume => $this->backupable->fs_path,
+            $this->backupable instanceof LocalPersistentVolume => $this->backupable->name,
+            default => 'Unknown storage',
+        };
+    }
+
+    public function sourcePath(): string
+    {
+        $target = $this->backupable;
+
+        if ($target instanceof LocalPersistentVolume) {
+            return filled($target->host_path) ? $target->host_path : $target->name;
+        }
+
+        if (! $target instanceof LocalFileVolume || ! $target->is_directory) {
+            throw new \RuntimeException('The backup target is not a directory or persistent volume.');
+        }
+
+        $path = str($target->fs_path);
+        if ($path->startsWith('.')) {
+            $resource = $this->targetResource();
+            if (! $resource || ! method_exists($resource, 'workdir')) {
+                throw new \RuntimeException('The directory backup workdir is unavailable.');
+            }
+
+            return $resource->workdir().$path->after('.')->toString();
+        }
+
+        return $path->toString();
+    }
+}

app/Models/ScheduledVolumeBackupExecution.php

@@ -0,0 +1,49 @@
+<?php
+
+namespace App\Models;
+
+use Illuminate\Database\Eloquent\Relations\BelongsTo;
+
+class ScheduledVolumeBackupExecution extends BaseModel
+{
+    protected $fillable = [
+        'uuid',
+        'scheduled_volume_backup_id',
+        's3_storage_id',
+        'status',
+        'message',
+        'size',
+        'filename',
+        'stop_container_ids',
+        'stop_recovery_pending',
+        's3_cleanup_pending',
+        'finished_at',
+        'local_storage_deleted',
+        's3_storage_deleted',
+        's3_uploaded',
+    ];
+
+    protected function casts(): array
+    {
+        return [
+            'size' => 'integer',
+            'finished_at' => 'datetime',
+            'stop_container_ids' => 'array',
+            'stop_recovery_pending' => 'boolean',
+            's3_cleanup_pending' => 'boolean',
+            'local_storage_deleted' => 'boolean',
+            's3_storage_deleted' => 'boolean',
+            's3_uploaded' => 'boolean',
+        ];
+    }
+
+    public function scheduledVolumeBackup(): BelongsTo
+    {
+        return $this->belongsTo(ScheduledVolumeBackup::class);
+    }
+
+    public function s3(): BelongsTo
+    {
+        return $this->belongsTo(S3Storage::class, 's3_storage_id');
+    }
+}

app/Services/DeploymentConfiguration/ApplicationConfigurationSnapshot.php

@@ -4,6 +4,8 @@ namespace App\Services\DeploymentConfiguration;
 
 use App\Models\Application;
 use App\Models\EnvironmentVariable;
+use App\Models\LocalFileVolume;
+use App\Models\LocalPersistentVolume;
 use App\Services\DeploymentConfiguration\Concerns\SummarizesDiffText;
 use Illuminate\Support\Arr;
 
@@ -47,6 +49,10 @@ class ApplicationConfigurationSnapshot
                     'label' => 'Environment Variables',
                     'items' => $this->environmentItems(),
                 ],
+                'storage' => [
+                    'label' => 'Storage',
+                    'items' => $this->storageItems(),
+                ],
             ],
         ];
     }
@@ -214,6 +220,40 @@ class ApplicationConfigurationSnapshot
             ->all();
     }
 
+    /**
+     * @return array<int, array<string, mixed>>
+     */
+    private function storageItems(): array
+    {
+        $volumes = $this->application->persistentStorages()
+            ->orderBy('id')
+            ->get(['id', 'name', 'mount_path', 'host_path'])
+            ->map(function (LocalPersistentVolume $volume): array {
+                $source = $volume->host_path ?: $volume->name;
+
+                return $this->item(
+                    key: 'volume_'.$volume->id,
+                    label: 'Volume mount',
+                    value: ['source' => $source, 'destination' => $volume->mount_path],
+                    impact: 'redeploy',
+                    displayValue: "{$source} → {$volume->mount_path}",
+                );
+            });
+
+        $fileMounts = $this->application->fileStorages()
+            ->orderBy('id')
+            ->get(['id', 'fs_path', 'mount_path', 'is_directory'])
+            ->map(fn (LocalFileVolume $file): array => $this->item(
+                key: 'file_'.$file->id,
+                label: $file->is_directory ? 'Directory mount' : 'File mount',
+                value: ['source' => $file->fs_path, 'destination' => $file->mount_path],
+                impact: 'redeploy',
+                displayValue: "{$file->fs_path} → {$file->mount_path}",
+            ));
+
+        return collect($volumes->all())->merge($fileMounts->all())->values()->all();
+    }
+
     /**
      * @return array<int, array<string, mixed>>
      */

app/View/Components/Forms/Checkbox.php

@@ -25,6 +25,7 @@ class Checkbox extends Component
         public ?string $helper = null,
         public string|bool|null $checked = false,
         public string|bool $instantSave = false,
+        public bool $live = false,
         public bool $disabled = false,
         public string $defaultClass = 'dark:border-neutral-700 text-coolgray-400 dark:bg-coolgray-100 rounded-sm cursor-pointer dark:disabled:bg-base dark:disabled:cursor-not-allowed focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-coollabs dark:focus-visible:ring-warning focus-visible:ring-offset-2 dark:focus-visible:ring-offset-base',
         public ?string $canGate = null,