WAL-G Plus — PostgreSQL WAL Archiving & Backups

Overview

What WAL-G Plus does.

WAL-G Plus is a maintained fork of wal-g/wal-g (forked June 2026), built to answer the question upstream leaves to guesswork: can this backup be restored, how far back, how fast, and will the retention policy still allow it tomorrow.

It inherits everything from upstream WAL-G — point-in-time recovery via continuous WAL archiving and incremental backups, storage backends for S3, Google Cloud Storage, Azure, Alibaba OSS, Swift, SSH, and local filesystem, and encryption via AWS KMS, Yandex Cloud KMS, OpenPGP, and libsodium — then adds a verification and evidence layer on top: backup-verify, doctor, pitr-window, restore-test, retention-validate, and compliance-report.

Each feature reports what it verified and declines to claim what it did not. Tested against PostgreSQL 10, 15, 16, 17, and 18, plus MongoDB, Redis, MySQL, MariaDB, Greenplum, and etcd. Runs locally with full control. No cloud dependency.

Why WAL-G Plus

All the original features. Now you can prove they work.

Backup Verification

backup-verify runs a two-tier verification — sentinel integrity, manifest completeness, checksum coverage, and decrypt canary, plus sampled tar-partition download. Know a backup restores before you need it.

PITR Window Analysis

pitr-window reports the ranges of time your storage can actually be restored to, the gaps between them, and which backups can no longer serve a restore. --min-window turns it into a CI gate against your RPO.

Restore Testing

restore-test restores a backup into a scratch directory for real, times it, and judges it against declared RTO/RPO. Refuses to touch PGDATA, cleans up after itself, and can start the cluster to measure WAL replay.

Retention Validation

retention-validate runs the real retention policy through the real delete handler and validates the window it would leave — catching policies that pass today only because they have never been applied.

Preflight Checks

doctor checks config resolution, storage read/write/delete, crypter round-trip, PostgreSQL connectivity, WAL archiving, backup freshness, and free space vs. restore size before a restore is attempted.

Audit Evidence

compliance-report runs doctor, backup-verify, retention-validate, pitr-window, and opt-in restore-test, and collects their output into one pass/fail evidence report for an audit or change record.

What's New

Beyond the fork.

Feature	Upstream WAL-G	WAL-G Plus
WAL archiving & PITR	✓	✓
Backup verification (backup-verify)	—	✓
Preflight checks (doctor)	—	✓
PITR window analysis (pitr-window)	—	✓
Delete dry-run with recovery window (delete --explain)	—	✓
Retention policy validation	—	✓
Real restore testing (restore-test)	—	✓
Audit evidence report	—	✓
Free-space preflight on restore	—	✓
Delta-chain depth limits enforced from storage	—	✓
Recovery objectives as config (RPO/RTO)	—	✓
Per-file SHA256 checksum inventory	—	✓
PostgreSQL 10–18 support	✓	✓
S3 / GCS / Azure / OSS / Swift / SSH / local	✓	✓
Encryption (KMS, OpenPGP, libsodium)	✓	✓
Prometheus exporter with backup-verify metrics	✓	✓

100% backward compatible with v0.14.1. The fork maintains the v0.14-era codebase with verified additions. Upstream WAL-G remains actively maintained — teams without a need for verification, PITR window analysis, and retention validation should use upstream. WAL-G Plus adds an evidence layer that proves backups restore, retention still covers the window, and RTO/RPO targets are actually met.

Use Cases

Where WAL-G Plus fits.

CI gate against your RPO

pitr-window --min-window fails a pipeline when retention has silently stopped covering the declared recovery point objective — before a restore discovers it.

Disaster recovery drills

restore-test performs a real restore into scratch storage and judges the result against RTO/RPO numbers. Prove the runbook works, on schedule, without touching production.

Compliance & audit

compliance-report produces one pass/fail evidence report combining backup verification, retention validation, and restore tests — ready for SOC 2, HIPAA, and PCI-DSS change records.

Multi-database backup automation

Tested against PostgreSQL 10–18, MongoDB, Redis, MySQL, MariaDB, Greenplum, and etcd. One verification layer across your entire database estate.

Getting Started

Backups You Can Actually Trust