If NeverWiped disappears

What you hold, and what we hold

Your backups are a standard restic repository (restic 0.18.1), one per server, stored in France. They are not in a NeverWiped format, and they are encrypted on your server with keys we never receive.

So the honest picture is this: the keys are yours, the format is open, but the storage is ours. While it answers, restic alone opens your backups. If it ever stops answering, only a copy you keep elsewhere is still there. The own copy section shows how to keep one with one command.

What stops, and what keeps working

Read your backups with restic alone

On your server, as root. The agent already installed restic 0.18.1 there (fingerprint checked), so nothing needs to be downloaded. These lines read the storage login from the agent's configuration without printing it:

C=/etc/neverwiped/config.json
URL=$(sed -n 's/.*"repo_url": "\([^"]*\)".*/\1/p' "$C")
USR=$(sed -n 's/.*"repo_user": "\([^"]*\)".*/\1/p' "$C")
PW=$(sed -n 's/.*"repo_password": "\([^"]*\)".*/\1/p' "$C")
RESTIC=/var/lib/neverwiped/bin/restic-0.18.1
export RESTIC_REPOSITORY="${URL%%://*}://$USR:$PW@${URL#*://}"
export RESTIC_PASSWORD_FILE=/etc/neverwiped/repo.key
$RESTIC snapshots
$RESTIC restore latest --target /root/restore

snapshots lists every backup with its date; restore latest brings the newest one back into /root/restore, without overwriting anything else. To pick a night, put its ID from the list in place of latest; to bring back one path, add --include /var/www. Database exports are in /root/restore/var/lib/neverwiped/dumps; re-import them as in a database. When you are done: rm -rf /root/restore.

Your storage login can read and add backups, never delete them. It keeps reading while an account is suspended (unpaid, or trial over): a suspension blocks new backups, not restores.

The server is lost too. Then you need the storage login from somewhere else than the server. It changes only when you run neverwiped recover, so you can keep it with your recovery key. Print it once, in your own terminal, and store the three lines in your password manager next to the recovery key:

grep -E '"repo_(url|user|password)"' /etc/neverwiped/config.json

Anyone who has both the storage login and the recovery key can read your backups, so they belong in the same safe place, nowhere else. On a new machine, install restic 0.18.1 and check its fingerprint, as in the restore guide (“Last resort”), then set RESTIC_REPOSITORY to the repo_url value with LOGIN:PASSWORD@ put right after https:// (it looks like rest:https://LOGIN:PASSWORD@storage.neverwiped.com/LOGIN/), and RESTIC_PASSWORD_FILE to a root-only file holding the recovery key.

Keep your own copy

This is the part that doesn't depend on us at all. Two ways, both with the keys you already have.

A plain folder, now and then. The newest backup, as ordinary files, on a disk or machine you control:

neverwiped restore latest --target /mnt/your-disk/neverwiped-latest --yes

A second restic repository you own, with every backup and its history. restic copies the snapshots from our storage into a repository on a disk, an SFTP machine or an S3-compatible bucket of yours, encrypted the same way. Set it up once, on your server, as root. Replace the sftp: address with yours (a local path such as /mnt/your-disk/neverwiped-copy works too):

C=/etc/neverwiped/config.json
URL=$(sed -n 's/.*"repo_url": "\([^"]*\)".*/\1/p' "$C")
USR=$(sed -n 's/.*"repo_user": "\([^"]*\)".*/\1/p' "$C")
PW=$(sed -n 's/.*"repo_password": "\([^"]*\)".*/\1/p' "$C")
RESTIC=/var/lib/neverwiped/bin/restic-0.18.1
export RESTIC_FROM_REPOSITORY="${URL%%://*}://$USR:$PW@${URL#*://}"
export RESTIC_FROM_PASSWORD_FILE=/etc/neverwiped/repo.key
export RESTIC_REPOSITORY='sftp:YOU@YOUR-MACHINE:/srv/neverwiped-copy'
export RESTIC_PASSWORD_FILE=/etc/neverwiped/repo.key
$RESTIC init --copy-chunker-params
umask 077
cat > /root/recovery.key
$RESTIC key add --new-password-file /root/recovery.key
rm -f /root/recovery.key

init --copy-chunker-params makes the copy deduplicate like the original, so later copies only send what changed. After cat > /root/recovery.key, paste your recovery key, press Enter, then Ctrl-D: key add lets your recovery key open the copy too, so it stays readable if the server and its repo.key are gone.

Then, each time you want the copy up to date (by hand, or from root's crontab with the same export lines in a root-only script):

$RESTIC copy
$RESTIC snapshots

copy only adds snapshots the copy doesn't have yet. It never deletes anything, neither in our storage nor in yours; to make your copy smaller, prune it yourself with restic's forget and its --keep-… options. The first copy reads and sends your whole repository; the next ones only what is new.

Both gone: the server and NeverWiped

With your own copy and your recovery key, on any Linux machine:

umask 077
cat > /root/recovery.key
export RESTIC_REPOSITORY='sftp:YOU@YOUR-MACHINE:/srv/neverwiped-copy'
export RESTIC_PASSWORD_FILE=/root/recovery.key
restic snapshots
restic restore latest --target /root/restore
rm -f /root/recovery.key

(Install restic 0.18.1 first and check its fingerprint, as in the restore guide.) Then put back what you need as in step 4 of the restore guide: your data and application folders, and your software's configuration files one by one, not the whole of /etc.

Test it today

Once, while everything works, then whenever you change servers:

1. On your server, run the restic alone lines with $RESTIC snapshots: the list must match neverwiped list.
2. Check that the recovery key, and the storage login if you chose to keep it, are in your password manager.
3. If you keep your own copy, open it with the recovery key alone, as in both gone, and restore one file from it.

What this page does not promise

• If our storage stops answering and you have no copy of your own, restic can't read what isn't reachable. Your keys alone are not your data.
• If you lose the server and the recovery key, nobody can read the backups, us included. See encryption.
• When you cancel, or an unpaid subscription runs its course, the backups are deleted on the dates of storage, retention and pruning. Make your copy before then.