Safe Backup

Safe Backup

Backup OpenClaw state directory and workspace with security best practices.

⚠️ Security Warnings

• Backup may contain sensitive data - review before sharing
• If uploading to GitHub - use a private repository and consider encryption
• auth-profiles.json is EXCLUDED - after restore, you must re-authenticate
• This script does NOT automatically push to any remote

Quick Start

1. Run Backup

~/.openclaw/skills/safe-backup/scripts/backup.sh

2. Check Output

Backup file: /tmp/safe-backup-20260223.tar.gz

3. Store Securely

See "Storage Options" below.

What Gets Backed Up

✅ Included (Safe to Backup)

❌ Excluded (Sensitive - Not Backed Up)

Complete Workflow

Phase 1: Backup

# Step 1: Run backup
~/.openclaw/skills/safe-backup/scripts/backup.sh

# Step 2: Verify backup contents
tar -tzf /tmp/safe-backup-20260223.tar.gz | less

# Step 3: Note the file path
# Output: /tmp/safe-backup-20260223.tar.gz

Phase 2: Storage

Choose one:

Option A: Local Encrypted Storage (Recommended)

# Create encrypted archive
openssl enc -aes-256-cbc -salt -in /tmp/safe-backup-20260223.tar.gz -out ~/backups/safe-backup-20260223.tar.gz.enc

# Enter a strong password when prompted

# Delete unencrypted backup
rm /tmp/safe-backup-20260223.tar.gz

Option B: Private GitHub Repository

# One-time setup: Create private repo on GitHub

# Clone your private repo
git clone https://github.com/YOUR_USERNAME/safe-backup.git ~/safe-backup

# Extract backup
mkdir -p ~/safe-backup/2026-02-23
tar -xzf /tmp/safe-backup-20260223.tar.gz -C ~/safe-backup/2026-02-23/

# Commit and push
cd ~/safe-backup
git add .
git commit -m "Backup 2026-02-23"
git push origin main

# Delete local copy
rm -rf ~/safe-backup
rm /tmp/safe-backup-20260223.tar.gz

Option C: rsync to Remote Server

# Example: sync to remote server
rsync -avz --delete \
  --exclude='*.log' \
  --exclude='sessions.json' \
  ~/.openclaw/ user@backup-server:/path/to/backups/

Phase 3: Restore

Step 1: Locate Backup

# If encrypted
openssl enc -aes-256-cbc -d -in ~/backups/safe-backup-20260223.tar.gz.enc -out /tmp/safe-backup.tar.gz

# If plain tarball
cp /path/to/safe-backup-20260223.tar.gz /tmp/

Step 2: Stop Gateway

systemctl --user stop openclaw-gateway

Step 3: Restore Files

# Extract to temporary location
mkdir -p /tmp/restore
tar -xzf /tmp/safe-backup.tar.gz -C /tmp/restore

# Restore state directory
cp -r /tmp/restore/state/* ~/.openclaw/

# Restore workspace (if needed)
cp -r /tmp/restore/workspace/* ~/.openclaw/workspace/

Step 4: Re-authenticate

Because auth-profiles.json was excluded, you must re-configure:

# Edit config to add authentication
openclaw config edit

# Or manually create auth-profiles.json
nano ~/.openclaw/agents/main/agent/auth-profiles.json

Required re-configuration:

• Telegram bot token
• Discord bot token
• Feishu credentials
• Any other API keys

Step 5: Restart Gateway

systemctl --user start openclaw-gateway

# Verify
openclaw status

Environment Variables

Example:

OPENCLAW_STATE_DIR=/data/openclaw ~/.openclaw/skills/safe-backup/scripts/backup.sh

Troubleshooting

"State directory not found"

# Check if OpenClaw is installed
ls -la ~/.openclaw

"Permission denied"

# Run with appropriate permissions
chmod +x ~/.openclaw/skills/safe-backup/scripts/backup.sh

Restore Fails

# Check backup integrity
tar -tzf /tmp/safe-backup.tar.gz

# If encrypted, verify password
openssl enc -aes-256-cbc -d -in backup.enc -o /dev/null

Best Practices

1. Backup regularly - at least weekly
2. Test restore - periodically verify backups work
3. Store offsite - keep backup in different location
4. Encrypt - never store unencrypted backups in cloud
5. Document - keep notes on what was re-configured after restore