Back up without thinking about it
By default ToutWAF backs itself up every 24 hours and keeps the 7 most recent archives; you can choose a time, an interval or a cron expression.
Back-up
Back up ToutWAF (and the linked ToutPanel) from one page: a daily schedule, a restore test after every backup, encrypted archives, off-site targets, a guided restore with a preview and an automatic rollback if it fails.
Where to find it in the console : Console: Infrastructure > Backups; command line: toutwafctl backup and toutwafctl restore.
What it is for
A backup that restores
Right after it is made, each local archive is restored to a blank: database integrity, same inventory, no private key in clear. An archive that does not restore is not a success and raises an alert.
Encrypted before it leaves
Every archive is encrypted (AES-256-GCM) before it is written or sent anywhere: with a passphrase, or with the installation's master key.
Restore without surprises
The restore guide compares the archive to the live database and says what would change before you confirm. If the console does not come back healthy, the previous data is put back.
What is backed up and where
The state of the control plane: the data plane holds nothing unique, you reinstall it and enrol it again.
The control plane
Database (policies and versions, sites, users, audit log, lists, certificates, integrations, events on request) and the master key. Secrets are sealed before they reach the database.
Off-site targets
A directory, S3, SFTP (server fingerprint pinned), WebDAV or a command, each with its own schedule, retention and bandwidth limit. Under licence: the local backup stays free.
ToutPanel
When a ToutPanel is linked, the page shows the state of its backup plans and can create one from the console. Its archives stay in ToutPanel.
Command line
toutwafctl backup create, list, download, targets, run, verify; toutwafctl restore for an offline restore, with the service stopped.
Stale backup alert
A default rule alerts when the last good backup of a destination is older than 36 hours.
Standby console
A second console can follow the first and take over by hand. Under licence.
The important point: the master key
It unseals integration passwords, SSO secrets, TOTP seeds and ACME credentials.
- A passphrase backup also carries the master key and restores on another server; a master-key backup is useless without that key.
- ToutWAF can generate the passphrase for you, shown once: keep a copy outside the server.
- Test a restore before you need it.
After a disaster
The documentation checklist, in short.
- Install a new host with the same version (or newer), restore ToutPanel first if it is linked, then ToutWAF.
- Nodes keep their token as long as the control plane's data directory was restored; otherwise create new enrolment tokens.
- Traffic is not interrupted by a control-plane outage: nodes serve their last good policy.
What is not done, or not proven
We prefer to say it plainly.
- No real S3, SFTP or WebDAV target has been tried: the tests use the directory target.
- No real ToutPanel and no backup on a real machine (systemd, full disk, system time zones): everything was tested with a fake ToutPanel API. The restore is tested in a fresh directory.
- The settings and accounts of ToutPanel itself cannot be reached with the token ToutWAF holds: save them from ToutPanel.
- Not done yet: a single destination and history for ToutPanel and ToutWAF archives, and backups in the PDF reports.
Use cases
Before an upgrade
You create a named backup, download it, then upgrade with a way back.
A copy off the server
A scheduled SFTP or S3 target, with a restore test after every upload.
Come back after an outage
On a new host, you follow the restore guide and check with the Doctor.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EditieGratis Inbegrepen in alle aanbiedingen, ook in de twee gratis (Free en Free +)Pro en hoger Betaalde aanbiedingen: zichtbaar in de console, vergrendeld zonder licentie. Vanaf Pro, tenzij Agency of Enterprise staat vermeld
Nog niet onder echte omstandigheden getest Werkt in de tests van het product, maar is nog niet geprobeerd met de echte dienst, het echte systeem of de echte apparatuur. De console toont dezelfde opmerking waar u de functie instelt.
- Geplande lokale back-up van de console, met een herstelproef na elke back-upGratis
- Begeleid herstel met voorbeeld, automatische herstart en terugdraaienGratis
- Geen geheim in leesbare vorm in een back-up: sleutels, tokens en wachtwoorden zijn verzegeld met de hoofdsleutelGratis
- Back-upplannen van het gekoppelde ToutPanel, gestart vanaf dezelfde paginaGratis
- Externe bestemmingen: S3, SFTP, WebDAV of een opdrachtPro en hoger
- Back-upserver: bestanden en databases (MySQL, MariaDB, PostgreSQL) van bewaakte servers, versleuteld met een herstelsleutel die alleen u bewaart, gecontroleerd met een herstelproefPro en hoger
- Reserveconsole: elk uur een versleutelde, gecontroleerde kopie en een begeleide, handmatige overname Nog niet onder echte omstandigheden getestAgency en hoger
- Overnemen vanaf een reserveconsole is nooit vergrendeld, ook niet zonder licentieGratis
Terugkeren naar de standaardwaarde van een geavanceerde optie is altijd mogelijk. Wat er aan het einde van een betaalde licentie gebeurt, staat in de veelgestelde vragen over de prijzen: 48 uur coulance, 48 uur alleen-lezen, daarna staat de WAF-bescherming uit tot de verlenging.
Prijzen Read the documentation
Zet vandaag nog een schild voor uw applicaties
Installeer het op uw eigen server, of neem contact met ons op om over licenties te praten.