restorable docs
Reference

Changelog

Notable changes to the agent, verifier, orchestrator, and these docs. Most recent first.

For the exact commit list of the public agent and verifier, see codeberg.org/restorable/restorable. Orchestrator and dashboard changes appear here as user-observable behavior; their source stays closed (see the trust model for what's open and why).

2026-04-27 (later)

Package + binary renamed: restorable-agent → restorable (REST-79)

Brand-forward rename. The customer-installed agent's distribution name drops the -agent suffix to match the backup-tool genre convention (restic, borg, kopia) and to read as the product rather than a component.

  • Package: apt install restorable-agent → apt install restorable (same for dnf).
  • Binary: /usr/bin/restorable-agent → /usr/bin/restorable.
  • systemd unit: restorable-agent.service → restorable.service.
  • Conffile: <root>/agent.yaml → <root>/config.yaml.
  • Env file: <root>/agent-env → <root>/env.
  • Download artefact: restorable-agent-linux-amd64 → restorable-linux-amd64.

Stays unchanged: the verifier (restorable-verify), the system user / group (restorable), the install root path (/var/lib/restorable).

Upgrade is automatic via the package manager: apt upgrade / dnf upgrade swaps the installed package transparently because the new restorable package declares Provides, Replaces, and Conflicts against the old name. install.sh additionally migrates any in-place agent.yaml / agent-env on disk to the new file names so existing keys, tokens, and source declarations survive the upgrade.

2026-04-27

Single-root CLI surface (REST-81)

The agent now operates on a single install directory ("the root") that holds agent.yaml, keys/, blobs/, receipts/, events/. --config and --state-dir are gone. Resolution order, first hit wins:

  1. --root DIR
  2. RESTORABLE_HOME env var (the systemd default)
  3. Walk-up from the cwd looking for agent.yaml
  4. $XDG_STATE_HOME/restorable (or $HOME/.local/state/restorable)
  5. /var/lib/restorable (system fallback)

doctor prints the resolved root + which branch chose it. Bare restorable (no subcommand) prints status, Tailscale-style. agent.yaml gains a defaults: block so single-source installs run zero-flag (restorable backup picks up the only declared source). Every per-call flag has an RESTORABLE_* env-twin; precedence is flag > env > defaults: > built-in.

Packaging: the conffile path moved from /etc/restorable/agent.yaml to /var/lib/restorable/agent.yaml. The installer migrates any pre-REST-81 /etc/restorable on upgrade so existing customer state survives. The systemd unit sets Environment=RESTORABLE_HOME=/var/lib/restorable; --config / --state-dir are gone from ExecStart.

2026-04-20

Docs site live

Every page in the sidebar is reachable. Pages carrying an action-item tag in the sidebar (A1, A2, etc.) describe the intended UX for work that is not yet fully implemented; they are the spec the implementation follows.

Installer auto-installs dependencies

curl https://get.restorable.app | bash now installs Docker via get.docker.com and minisign via the distro package manager if they are missing. Opt out with RESTORABLE_SKIP_PREREQS=1.

Self-serve signup (A1)

POST /api/auth/signup and POST /api/auth/signup/verify are live in the orchestrator. The React signup form in the dashboard sits on top of them. The landing page links through at Sign in in the header; follow the form's Sign up link for a new org.

Hardened systemd unit

The shipped unit now adds PrivateTmp, ProtectKernelTunables, ProtectKernelModules, ProtectControlGroups, RestrictNamespaces, LockPersonality, MemoryDenyWriteExecute, RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6, CapabilityBoundingSet=, and AmbientCapabilities=. systemd-analyze security restorable.service scores in the OK / good range.

get.restorable.app

Binary distribution surface now live. Serves install.sh at the root; version folders hold signed binaries and minisign signatures once the first release ships.

Publish-install workflow

GitHub Actions pipeline in the restorable repo auto-uploads install.sh to the bucket on any change, with version templating on tagged releases.

Terminology: "checks" not "smoke tests"

The wire-protocol spec caught up with the codebase's terminology; smoke_tests is out, checks is in, everywhere.

Earlier

Pre-launch work is tracked internally. The changelog starts producing per-release entries from the first tagged release (v0.1.0) onwards.