# If NeverWiped disappears

What happens to your backups if NeverWiped stops, and the exact steps to read them with the open-source restic tool alone: no agent, no dashboard, no account. Do the test on this page once while everything works, so the day you need it is not the first time.

## What you hold, and what we hold {#what-you-hold}

Your backups are a **standard restic repository** (restic 0.18.1), one per server, stored in France. They are not in a NeverWiped format, and they are encrypted on your server with keys we never receive.

| What | Where | Needed to read the backups |
|---|---|---|
| Repository key | `/etc/neverwiped/repo.key` on your server | Yes (or the recovery key) |
| Recovery key | Your password manager (shown once at install) | Yes, if the server is lost |
| Storage login (`repo_url`, `repo_user`, `repo_password`) | `/etc/neverwiped/config.json` on your server | Yes, to reach our storage |
| The storage itself | Our servers in France | Yes, unless you keep your own copy |

So the honest picture is this: the keys are yours, the format is open, but the **storage is ours**. While it answers, restic alone opens your backups. If it ever stops answering, only a copy you keep elsewhere is still there. The [own copy](#own-copy) section shows how to keep one with one command.

## What stops, and what keeps working {#what-stops}

| If NeverWiped stops | |
|---|---|
| Dashboard, account, emails and alerts | Stop |
| Scheduled backups by the agent | Stop: each backup asks our platform for its settings first, and fails without it |
| `neverwiped recover` (moving to a new server with your account) | Stops: it needs your account |
| Support (for example a new storage login) | Stops |
| `neverwiped restore` on your server | Keeps working while the storage answers: it talks to the storage directly, and its report to our platform is optional |
| restic alone, with the commands below | Keeps working while the storage answers |
| A copy you keep elsewhere ([own copy](#own-copy)) | Keeps working, whatever happens to us |
| The files on your server | Untouched: nothing on your server is removed when our platform stops |

## Read your backups with restic alone {#plain-restic}

On your server, as root. The agent already installed restic 0.18.1 there (fingerprint checked), so nothing needs to be downloaded. These lines read the storage login from the agent's configuration without printing it:

```sh
C=/etc/neverwiped/config.json
URL=$(sed -n 's/.*"repo_url": "\([^"]*\)".*/\1/p' "$C")
USR=$(sed -n 's/.*"repo_user": "\([^"]*\)".*/\1/p' "$C")
PW=$(sed -n 's/.*"repo_password": "\([^"]*\)".*/\1/p' "$C")
RESTIC=/var/lib/neverwiped/bin/restic-0.18.1
export RESTIC_REPOSITORY="${URL%%://*}://$USR:$PW@${URL#*://}"
export RESTIC_PASSWORD_FILE=/etc/neverwiped/repo.key
$RESTIC snapshots
$RESTIC restore latest --target /root/restore
```

`snapshots` lists every backup with its date; `restore latest` brings the newest one back into `/root/restore`, without overwriting anything else. To pick a night, put its ID from the list in place of `latest`; to bring back one path, add `--include /var/www`. Database exports are in `/root/restore/var/lib/neverwiped/dumps`; re-import them as in [a database](/docs/getting-started#database). When you are done: `rm -rf /root/restore`.

Your storage login can read and add backups, never delete them. It keeps reading while an account is suspended (unpaid, or trial over): a suspension blocks new backups, not restores.

**The server is lost too.** Then you need the storage login from somewhere else than the server. It changes only when you run `neverwiped recover`, so you can keep it with your recovery key. Print it once, in your own terminal, and store the three lines in your password manager next to the recovery key:

```sh
grep -E '"repo_(url|user|password)"' /etc/neverwiped/config.json
```

Anyone who has both the storage login and the recovery key can read your backups, so they belong in the same safe place, nowhere else. On a new machine, install restic 0.18.1 and check its fingerprint, as in the [restore guide](/docs/getting-started#whole-server) (“Last resort”), then set `RESTIC_REPOSITORY` to the `repo_url` value with `LOGIN:PASSWORD@` put right after `https://` (it looks like `rest:https://LOGIN:PASSWORD@storage.neverwiped.com/LOGIN/`), and `RESTIC_PASSWORD_FILE` to a root-only file holding the recovery key.

## Keep your own copy {#own-copy}

This is the part that doesn't depend on us at all. Two ways, both with the keys you already have.

**A plain folder, now and then.** The newest backup, as ordinary files, on a disk or machine you control:

```sh
neverwiped restore latest --target /mnt/your-disk/neverwiped-latest --yes
```

**A second restic repository you own, with every backup and its history.** restic copies the snapshots from our storage into a repository on a disk, an SFTP machine or an S3-compatible bucket of yours, encrypted the same way. Set it up once, on your server, as root. Replace the `sftp:` address with yours (a local path such as `/mnt/your-disk/neverwiped-copy` works too):

```sh
C=/etc/neverwiped/config.json
URL=$(sed -n 's/.*"repo_url": "\([^"]*\)".*/\1/p' "$C")
USR=$(sed -n 's/.*"repo_user": "\([^"]*\)".*/\1/p' "$C")
PW=$(sed -n 's/.*"repo_password": "\([^"]*\)".*/\1/p' "$C")
RESTIC=/var/lib/neverwiped/bin/restic-0.18.1
export RESTIC_FROM_REPOSITORY="${URL%%://*}://$USR:$PW@${URL#*://}"
export RESTIC_FROM_PASSWORD_FILE=/etc/neverwiped/repo.key
export RESTIC_REPOSITORY='sftp:YOU@YOUR-MACHINE:/srv/neverwiped-copy'
export RESTIC_PASSWORD_FILE=/etc/neverwiped/repo.key
$RESTIC init --copy-chunker-params
umask 077
cat > /root/recovery.key
$RESTIC key add --new-password-file /root/recovery.key
rm -f /root/recovery.key
```

`init --copy-chunker-params` makes the copy deduplicate like the original, so later copies only send what changed. After `cat > /root/recovery.key`, paste your recovery key, press Enter, then Ctrl-D: `key add` lets your recovery key open the copy too, so it stays readable if the server and its `repo.key` are gone.

Then, each time you want the copy up to date (by hand, or from root's crontab with the same `export` lines in a root-only script):

```sh
$RESTIC copy
$RESTIC snapshots
```

`copy` only adds snapshots the copy doesn't have yet. It never deletes anything, neither in our storage nor in yours; to make your copy smaller, prune it yourself with restic's `forget` and its `--keep-…` options. The first copy reads and sends your whole repository; the next ones only what is new.

## Both gone: the server and NeverWiped {#both-gone}

With your own copy and your recovery key, on any Linux machine:

```sh
umask 077
cat > /root/recovery.key
export RESTIC_REPOSITORY='sftp:YOU@YOUR-MACHINE:/srv/neverwiped-copy'
export RESTIC_PASSWORD_FILE=/root/recovery.key
restic snapshots
restic restore latest --target /root/restore
rm -f /root/recovery.key
```

(Install restic 0.18.1 first and check its fingerprint, as in the [restore guide](/docs/getting-started#whole-server).) Then put back what you need as in step 4 of the restore guide: your data and application folders, and your software's configuration files one by one, not the whole of `/etc`.

## Test it today {#test}

Once, while everything works, then whenever you change servers:

1. On your server, run the [restic alone](#plain-restic) lines with `$RESTIC snapshots`: the list must match `neverwiped list`.
2. Check that the recovery key, and the storage login if you chose to keep it, are in your password manager.
3. If you keep [your own copy](#own-copy), open it with the recovery key alone, as in [both gone](#both-gone), and restore one file from it.

## What this page does not promise {#limits}

- If our storage stops answering and you have no copy of your own, restic can't read what isn't reachable. Your keys alone are not your data.
- If you lose the server **and** the recovery key, nobody can read the backups, us included. See [encryption](/docs/encryption).
- When you cancel, or an unpaid subscription runs its course, the backups are deleted on the dates of [storage, retention and pruning](/docs/storage#deletion). Make your copy before then.