5. Backup and restore

A backup holds everything that cannot be recreated: the certificate authority (so every issued profile stays valid), the server's state, the generated OpenVPN and DNS configuration, the application's settings and its database (accounts, roles, rules). It contains secrets, so it is encrypted with a passphrase. Without the passphrase it cannot be opened; if you lose the passphrase the backup is useless, and nobody can recover it.

Backups are made and restored only on the server's console, never from the web page.

Making a backup

sudo /usr/lib/tunnelry/vpnctl backup.create

It asks for a passphrase (at least 12 characters, twice) and writes /var/lib/tunnelry/backups/tunnelry-backup-<version>-<time>.tbk, readable by root only. Copy the file off the server (another machine, a safe storage): a backup on the server it protects does not help if the server is lost. Keep the passphrase somewhere else, for example in a password manager.

Make a backup before a major change and on a schedule that matches how often your accounts and profiles change. Because profiles are only valid together with their certificate authority, a backup older than a profile does not contain that profile.

Restoring

Install Tunnelry on the server first (the same version or newer; a backup made by a newer version is refused). Then:

sudo /usr/lib/tunnelry/vpnctl backup.restore

It asks for the passphrase, the path of the backup file and for the word restore, because this replaces the data of the installation with the backup. It then stops the VPN, puts the restored files in place, reloads the firewall, restarts the services and brings the database up to date. Everything it replaced is kept in /var/lib/tunnelry/backups/pre-restore-<time>/ (the two latest are kept). If the restored installation does not come up, the previous data is put back automatically.

A wrong passphrase or a damaged or tampered file is refused before anything is touched.

Restore onto a server with the same address and web interface port (the backup holds the web application's settings, not the web server files, which the installer writes). Devices keep working, because their certificates and the server's address are the same.

Moving to a new server

1. Make a backup on the old server and copy it off.
2. Install Tunnelry on the new server, with --address set to the address people use.
3. Restore the backup there.
4. Point the DNS name (or move the IP address) to the new server. Existing profiles keep working if the address they hold does not change.

Next: access to the web interface.