Data, databases, and storage

Native installation

.dailies-delivery/
├── app/       application code
├── master/    Federation Master, if used
├── config/    local configuration
├── data/      ← DATABASE
│   ├── videohub.db
│   └── storage/federation/
├── media/     technical space reserved for local media storage
├── logs/      logs
├── backups/   backups
└── runtime/   Python environment

The main database is .dailies-delivery/data/videohub.db. The Federation node's cryptographic identity is stored in data/storage/federation/. It is never included in the source repository or distribution ZIP.

Media

Each project keeps its own physical path, recorded in the database. The installation's media/ folder does not automatically move existing media and should not be treated as the only project folder. A folder published as the Federated Library stays at its configured location and is not automatically included in project backups; add it explicitly to your backup plan.

Docker

dailies_data      → /data
dailies_media     → /media
dailies_keys      → /keys (encryption key)
federation_data   → /data

Docker volumes are persistent. Keep dailies_keys with the data volumes. User databases are not bundled into the image.

Updates

The update and repair scripts do not delete data/, media/, logs/, or backups/. An older database at app/videohub.db is moved to data/videohub.db if no target database exists.

Minimum backup set

• data/videohub.db
• data/storage/federation/
• backups/
• the physical project paths containing the media

Local protection

On macOS and Linux, Dailies Delivery restricts the data/ directory to the account running the server and limits access to the database, SQLite temporary files, and log. Database exports and backups are created with private permissions where the filesystem supports them. On Windows, review the ACLs for the account running Dailies Delivery.

Encryption at rest: SQLite remains in its normal database format, while configuration secrets, TOTP secrets, and session tokens are encrypted with AES-256-GCM. Database exports and automatic backups use the .db.enc extension. Media copies created by the backup system are encrypted file by file as .ddenc. On macOS and Linux, Dailies Delivery also restricts data and key file permissions; on Windows, review the server account's ACLs.

The key is created on first startup at runtime/dailies-encryption.key (native installation), or in the Docker volume dailies_keys. You can provide it with DAILIES_ENCRYPTION_KEY (64 hexadecimal characters). Copy the key to a secrets manager or secure medium separate from the backups. Without the matching key, encrypted secrets and backups cannot be recovered. Do not remove the Docker key volume during reinstallation.

To restore files, use install/decrypt-backup.py with --key and --output. It decrypts to a new directory and verifies integrity before writing the result. Existing plaintext database backups are converted to .db.enc on the next database backup; old plaintext media copies are converted on the next backup of their project.