# noust self-backup

Back up Noust's own state (store, configuration, secrets, keys, certificates, units).

```bash
noust self-backup [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`create`](#noust-self-backup-create), [`delete`](#noust-self-backup-delete), [`fetch`](#noust-self-backup-fetch), [`list`](#noust-self-backup-list), [`push`](#noust-self-backup-push), [`remote`](#noust-self-backup-remote), [`restore`](#noust-self-backup-restore), [`run`](#noust-self-backup-run), [`schedule`](#noust-self-backup-schedule), [`verify`](#noust-self-backup-verify)

## noust self-backup create

Take a bundle of Noust's own state into one encrypted file.

```bash
noust self-backup create [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--passphrase-file` | Read the passphrase from this file (mode 600), not from a prompt. |  |
| `--json` | Print the bundle as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup delete

Delete a bundle from this server. Copies on destinations stay.

```bash
noust self-backup delete [OPTIONS] BUNDLE
```

Arguments: `bundle`

| Option | What it does | Default |
|---|---|---|
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup fetch

Bring a bundle from a destination to this server, checked against its digest.

```bash
noust self-backup fetch [OPTIONS] NAME
```

Arguments: `name`

| Option | What it does | Default |
|---|---|---|
| `--from` | A backup destination. |  |
| `--host` | The server's folder there; this server's by default. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup list

List the bundles on this server, newest first.

```bash
noust self-backup list [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the bundles as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup push

Send a bundle to a destination. It is encrypted by a passphrase that is not sent.

```bash
noust self-backup push [OPTIONS] BUNDLE
```

Arguments: `bundle`

| Option | What it does | Default |
|---|---|---|
| `--to` | A backup destination. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup remote

List the bundles a destination holds, for this server or another one.

```bash
noust self-backup remote [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--from` | A backup destination. |  |
| `--host` | List the bundles of another server (its folder name there). |  |
| `--json` | Print the listing as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup restore

Put Noust's own state back from a bundle, on this server.

```bash
noust self-backup restore [OPTIONS] BUNDLE
```

Arguments: `bundle`

| Option | What it does | Default |
|---|---|---|
| `--force` | Restore over a server that already holds state. |  |
| `--no-safety-copy` | Do not take a bundle of what is here first. Nothing is then left to undo it with. |  |
| `--no-restart` | Do not start the services and timers again afterwards. |  |
| `--yes`, `-y` | Do not ask for confirmation. |  |
| `--passphrase-file` | Read the passphrase from this file (mode 600), not from a prompt. |  |
| `--json` | Print what the restore did as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup run

Run the schedule now: back up, prove the bundle, send, prune.

```bash
noust self-backup run [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print what the run did as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup schedule

Set, show or remove the schedule of Noust's own state backup.

```bash
noust self-backup schedule [OPTIONS] COMMAND [ARGS]...
```

Subcommands: [`remove`](#noust-self-backup-schedule-remove), [`set`](#noust-self-backup-schedule-set), [`show`](#noust-self-backup-schedule-show)

## noust self-backup schedule remove

Remove the schedule and its timer. The bundles and the stored passphrase stay.

```bash
noust self-backup schedule remove [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--force`, `-f`, `-y` | Do not ask for confirmation. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup schedule set

Create or replace the schedule, and its timer.

```bash
noust self-backup schedule set [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--schedule` | hourly, daily, weekly, monthly or a systemd OnCalendar expression. | `daily` |
| `--keep` | Scheduled bundles to keep here, or 'none'. | `7` |
| `--keep-days` | Days to keep one here, or 'none'. | `30` |
| `--keep-gb` | The most the scheduled backups kept here may weigh together, in gigabytes, or 'none'. The newest always stays, whatever its size. | `none` |
| `--to` | Send each bundle to this destination, keeping COUNT, DAYS and GB there. Repeatable. |  |
| `--remote-only` | Keep nothing on this server: delete each bundle here once every destination holds it and its upload was checked. For a small disk; needs a --to. |  |
| `--keep-passphrase` | Keep the passphrase already stored instead of asking for one. |  |
| `--disable` | Keep the settings but install no timer. |  |
| `--max-runtime` | Stop a run that takes longer than this: 90m, 2h, 1d or a number of seconds (1 minute to 7 days). No limit by default. |  |
| `--timezone` | Read the schedule in this time zone, such as Europe/Madrid (timedatectl list-timezones lists them). The server's clock by default. |  |
| `--passphrase-file` | Read the passphrase from this file (mode 600), not from a prompt. |  |
| `--json` | Print the schedule as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup schedule show

Show the schedule of Noust's own state backup.

```bash
noust self-backup schedule show [OPTIONS]
```

| Option | What it does | Default |
|---|---|---|
| `--json` | Print the schedule as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |

## noust self-backup verify

Prove a bundle restorable without restoring it.

```bash
noust self-backup verify [OPTIONS] BUNDLE
```

Arguments: `bundle`

| Option | What it does | Default |
|---|---|---|
| `--passphrase-file` | Read the passphrase from this file (mode 600), not from a prompt. |  |
| `--json` | Print the verdict as JSON. |  |
| `--reason` | Why this change is made (a change reference, a ticket). Recorded with the command in the audit log; required only where a compliance framework asks for it (ENS) or security.change_reasons is on. |  |