Backup and restore¶
What needs to be backed up where depends on which parts of Krywerk you use. Krywerk itself doesn't store any files – the encrypted folders live wherever you created them and are backed up there (OneDrive, NAS, the organization's backup).
What people must keep safe¶
Krywerk cannot recover any of these secrets. Without them, the data is lost.
| Secret | Who | For what | Keep it |
|---|---|---|---|
| Vault password | everyone with a personal vault | open the personal vault | password manager |
| Unlock code | everyone with team folders | unlock a new device | password manager or printout |
| Recovery key (44 words) | managers of a team folder | open a team folder without the server | printout in a safe/deposit box, separate from the computer |
Boxcryptor key file (.bckey) and password |
only with Boxcryptor (legacy) | open old folders | as before, until the migration is finished |
Desktop app¶
The app only stores settings (paths, drive names, key server address) – no keys in plaintext. A backup is not necessary; after a reinstall, add the drives again ("+ Add › Personal vault or existing folder …") and unlock the device for team folders with the unlock code.
| System | Settings |
|---|---|
| Windows | %APPDATA%\Krywerk\config.json |
| macOS | ~/Library/Application Support/Krywerk/config.json |
| Linux | ~/.config/Krywerk/config.json |
If config.json is damaged, Krywerk creates a copy config.json.defekt-<time> and starts with default settings; the
app shows a notice about it.
Krywerk Server¶
The server's database contains all access grants and the encrypted keys of the team folders. Without it, team folders can only be opened with the recovery key.
Backing up¶
What to back up: the server's database (it contains everything) – with your own Keycloak also its database
(docker compose … exec keycloak-db pg_dump -U keycloak keycloak > keycloak.sql) – as well as krywerk.env/.env.
The team folders themselves are backed up by the cloud storage.
# daily at 02:15, keep for 30 days (crontab of the operating user)
15 2 * * * /opt/krywerk/crates/kw-server/deploy/backup.sh /var/backups/krywerk 30 >>/var/log/krywerk-backup.log 2>&1
backup.sh uses docker compose in the deploy/ folder; with the Keycloak add-on, set
COMPOSE_FILE=compose.yaml:compose.keycloak.yaml first. Copy backups off-site regularly and practice a restore at
least every quarter (krywerk-server verify on the copy is not enough as practice – restore once into a test
instance and open a team folder).
Restoring¶
./restore.sh /var/backups/krywerk/krywerk-server-<time>.sqlite3
stops the server, verifies the backup, restores it (the previous database remains in the volume as
krywerk-server.sqlite3.vor-restore-<time>) and restarts. Consequences: anything created after the backup is
missing: new team folders are no longer known (opening → "No access"), newly unlocked devices must be unlocked again,
new access grants must be granted again. Team folders whose keys existed only on the server are lost without a
backup – unless there is a recovery key (F9). Hence: back up regularly.
Checking whether a backup is usable¶
docker compose exec server krywerk-server verify /data/krywerk-server.sqlite3 # running database
krywerk-server verify /var/backups/krywerk/krywerk-server-<time>.sqlite3 # backup (no configuration needed)
verify checks integrity and schema version and shows the number of people, devices and team folders.
Opening team folders without the server¶
With the recovery key, krywerk-mount opens a team folder even if the server is permanently lost – the key is prompted
for without echoing:
krywerk-mount <folder of the team folder> --recovery-key
How to get a team folder onto a new server afterwards is described in Emergency access.