Import backup

Before you apply — what a restore does not bring back

A restore returns configuration. It does not return credentials, secret values, or this box's identity.

User accounts & access control — the auth database (accounts, RBAC roles, MFA/TOTP seeds, recovery codes) is never in a bundle. On a rebuilt box nobody can sign in until you create an account from the root console.

Secret values — a bundle carries references to secrets, never the secrets. Most references restore quietly and the service simply does not come up. OSPF and BGP authentication keys are the exception: they are read during apply, and one that is absent from the secret store aborts the restore and rolls back every change it had already made. Validate and dry-run do not check for it, so a clean pre-flight does not predict a successful apply on a rebuilt box.

Absent from a rebuilt box's store — WireGuard private and pre-shared keys, IPsec PSK/EAP credentials, the IPsec CA passphrase, the PPPoE authkey, the CARP passphrase, alerting webhook bearer tokens, and — if this box is half an HA pair — the HA sync pre-shared key, without which the pair cannot sync at all. Re-create each one, then re-apply its domain so the running daemon picks it up. (An alert channel's URL is part of the configuration and does come back; only its bearer token is a stored secret.)

This box's certificate and audit trail — the certificate domain is intent only: a restore writes the stored configuration but installs no certificate and reloads no web server, so a rebuilt box keeps serving its first-boot self-signed pair. TLS private keys live on disk, not in the secret store, and are in no bundle either way. Logs, the generation ledger and the audit integrity key are outside every bundle.

The deployment root key — .cap-master never travels in a bundle. Hardware that never held the original cannot verify this bundle's signature, and this page refuses it. Restoring the key from custody is the clean fix. Failing that, the root console can proceed without verification — deliberately not from here, and the runbook below covers it.

Full procedure: docs/RECOVERY.md in the source release, or /etc/examples/ogmaprotect/README.restore on the box.