Back up without thinking about it
By default ToutWAF backs itself up every 24 hours and keeps the 7 most recent archives; you can choose a time, an interval or a cron expression.
Cópias de segurança
Back up ToutWAF (and the linked ToutPanel) from one page: a daily schedule, a restore test after every backup, encrypted archives, off-site targets, a guided restore with a preview and an automatic rollback if it fails.
Where to find it in the console : Console: Infrastructure > Backups; command line: toutwafctl backup and toutwafctl restore.
What it is for
A backup that restores
Right after it is made, each local archive is restored to a blank: database integrity, same inventory, no private key in clear. An archive that does not restore is not a success and raises an alert.
Encrypted before it leaves
Every archive is encrypted (AES-256-GCM) before it is written or sent anywhere: with a passphrase, or with the installation's master key.
Restore without surprises
The restore guide compares the archive to the live database and says what would change before you confirm. If the console does not come back healthy, the previous data is put back.
What is backed up and where
The state of the control plane: the data plane holds nothing unique, you reinstall it and enrol it again.
The control plane
Database (policies and versions, sites, users, audit log, lists, certificates, integrations, events on request) and the master key. Secrets are sealed before they reach the database.
Off-site targets
A directory, S3, SFTP (server fingerprint pinned), WebDAV or a command, each with its own schedule, retention and bandwidth limit. Under licence: the local backup stays free.
ToutPanel
When a ToutPanel is linked, the page shows the state of its backup plans and can create one from the console. Its archives stay in ToutPanel.
Command line
toutwafctl backup create, list, download, targets, run, verify; toutwafctl restore for an offline restore, with the service stopped.
Stale backup alert
A default rule alerts when the last good backup of a destination is older than 36 hours.
Standby console
A second console can follow the first and take over by hand. Under licence.
The important point: the master key
It unseals integration passwords, SSO secrets, TOTP seeds and ACME credentials.
- A passphrase backup also carries the master key and restores on another server; a master-key backup is useless without that key.
- ToutWAF can generate the passphrase for you, shown once: keep a copy outside the server.
- Test a restore before you need it.
After a disaster
The documentation checklist, in short.
- Install a new host with the same version (or newer), restore ToutPanel first if it is linked, then ToutWAF.
- Nodes keep their token as long as the control plane's data directory was restored; otherwise create new enrolment tokens.
- Traffic is not interrupted by a control-plane outage: nodes serve their last good policy.
What is not done, or not proven
We prefer to say it plainly.
- No real S3, SFTP or WebDAV target has been tried: the tests use the directory target.
- No real ToutPanel and no backup on a real machine (systemd, full disk, system time zones): everything was tested with a fake ToutPanel API. The restore is tested in a fresh directory.
- The settings and accounts of ToutPanel itself cannot be reached with the token ToutWAF holds: save them from ToutPanel.
- Not done yet: a single destination and history for ToutPanel and ToutWAF archives, and backups in the PDF reports.
Use cases
Before an upgrade
You create a named backup, download it, then upgrade with a way back.
A copy off the server
A scheduled SFTP or S3 target, with a restore test after every upload.
Come back after an outage
On a new host, you follow the restore guide and check with the Doctor.
What is included, by edition
The basics are free; the advanced options need a paid offer. An option under licence stays visible in the console, locked, never hidden.
EdiçãoGratuito Incluído em todas as ofertas, incluindo as duas gratuitas (Free e Free +)Pro e superiores Ofertas pagas: visível na consola, bloqueada sem licença. A partir do Pro, salvo indicação Agency ou Enterprise
Ainda não testada em condições reais Funciona nos testes do produto, mas ainda não foi testada com o serviço, o sistema ou o equipamento reais. A consola mostra a mesma nota onde configura a função.
- Cópia de segurança local agendada da consola, com um teste de restauração após cada cópiaGratuito
- Restauração guiada com pré-visualização, reinício automático e reversãoGratuito
- Nenhum segredo em claro numa cópia: chaves, tokens e palavras-passe são selados com a chave mestraGratuito
- Planos de cópia de segurança do ToutPanel associado, iniciados a partir da mesma páginaGratuito
- Destinos externos: S3, SFTP, WebDAV ou um comandoPro e superiores
- Servidor de cópias de segurança: ficheiros e bases de dados (MySQL, MariaDB, PostgreSQL) dos servidores supervisionados, cifrados com uma chave de recuperação que só você guarda, verificados por um teste de restauraçãoPro e superiores
- Consola de reserva: cópia cifrada e verificada a cada hora, tomada de controlo guiada e manual Ainda não testada em condições reaisAgency e superiores
- Assumir o controlo a partir de uma consola de reserva nunca é bloqueado, mesmo sem licençaGratuito
Voltar ao valor predefinido de uma opção avançada é sempre possível. O que acontece no fim de uma licença paga está descrito nas perguntas frequentes de preços: 48 horas de tolerância, 48 horas só de leitura e depois a proteção WAF é desativada até à renovação.
Coloque hoje um escudo à frente das suas aplicações
Instale-o no seu próprio servidor, ou contacte-nos para falar de licenças.