\r \r

OpenClaw Backup → Cloudflare R2 (via restic)\r

\r This skill helps the user create complete, encrypted, off-site backups of their OpenClaw installation and restore them on any machine. It backs up everything OpenClaw's built-in .bak misses: credentials, agents, workspace, and cron — not just openclaw.json.\r \r

When to use\r

\r

• The user wants to back up their OpenClaw setup (config, agents, credentials).\r
• The user lost agents/config (e.g., after openclaw doctor --fix) and wants protection going forward.\r
• The user wants to restore a backup or migrate OpenClaw to a new PC.\r
• The user wants automatic daily backups.\r \r

What it backs up\r

\r openclaw backup create --verify produces a verified .tar.gz containing config, credentials, agents, workspace, and cron. restic then encrypts and deduplicates it locally and uploads to Cloudflare R2. Retention keeps 7 daily + 4 weekly + 6 monthly snapshots.\r \r

Prerequisites (guide the user to set these up)\r

\r

1. restic installed (on PATH or at ./restic/restic.exe).\r
2. A Cloudflare R2 bucket + S3 API token.\r
3. Copy .env.example → .env and fill RESTIC_REPOSITORY, AWS_ACCESS_KEY_ID, AWS_SECRET_ACCESS_KEY.\r
4. Create .restic-pass with a strong password. Critical: this is the only key to the encrypted backups — store it safely and separately. Without it, restore is impossible.\r
5. Initialize once: restic init.\r \r

Never commit .env or .restic-pass. They are git-ignored. Never print their contents.\r \r

Running a backup\r

\r

.\backup.ps1\r
```\r
This runs `openclaw backup create --verify`, uploads via restic to R2, prunes old snapshots, and removes the local tar. Logs go to `logs/`.\r
\r
## Testing a restore (safe, non-destructive)\r
\r
```powershell\r
.	est-restore.ps1\r
```\r
Downloads the latest snapshot, extracts it, and validates with `openclaw backup verify`. Does **not** touch the live `.openclaw`.\r
\r
## Restoring (any PC)\r
\r
Copy the `portable/` folder (with `restic/restic.exe`, `.env`, `.restic-pass`) to the target machine and run:\r
```powershell\r
.\portable\restore-portable.ps1\r
```\r
It stops the gateway, pulls the latest backup from R2, and installs to `%USERPROFILE%\.openclaw`, **preserving** the current `.openclaw` as `.openclaw.backup-\x3Cdate>` first.\r
\r
## Automating daily backups (Windows)\r
\r
Register a Task Scheduler job that runs `backup.ps1` daily with `-StartWhenAvailable` so it catches up if the PC was off. See the README for the exact `Register-ScheduledTask` command.\r
\r
## Safety notes\r
\r
- Always confirm the user has saved their `.restic-pass` somewhere safe before relying on backups.\r
- When helping configure, never echo secret values; have the user paste them into `.env`/`.restic-pass` themselves.\r
- The restore preserves the existing `.openclaw` as a timestamped backup, so a restore is reversible.\r