OpenClaw Backup

Use this skill for backup, verify, restore, and disaster-recovery workflows for an OpenClaw workspace.

Use when

• setting up backup and restore for an OpenClaw agent or workspace
• creating a cloud-safe operational backup
• creating an encrypted secrets backup for local recovery
• verifying a backup set before trusting it
• dry-running or executing a restore
• pushing an operational backup archive to GitHub

Do not use when

• the user wants general file sync or generic backup advice unrelated to OpenClaw
• you only need a one-off copy of a few files
• secrets would be pushed or shared without encryption
• the restore target or archive path is unclear

Default workflow

1. Identify the job

Choose one lane:

• backup
• verify
• restore
• push operational archive to GitHub
• schedule / drill / pre-change snapshot

1. Start with the core path

Use the main scripts first:

• bash {baseDir}/scripts/backup.sh
• bash {baseDir}/scripts/verify.sh --manifest /manifest.json --archive /backup.tar.gz
• bash {baseDir}/scripts/restore.sh --manifest /manifest.json --archive /backup.tar.gz --dry-run
• bash {baseDir}/scripts/push-to-github.sh --manifest /manifest.json --archive /backup.tar.gz

1. Keep the archive model straight

Default to operational-only backups for cloud storage.

Secrets are opt-in and must stay encrypted with age.

1. Use dry-run before restore

Restore is high-blast-radius. Prefer --dry-run before a real restore.

1. Load references only as needed
• references/restore-guide.md — full disaster recovery walkthrough
• references/what-to-backup.md — file coverage and rationale
• references/retention-policy.md — retention guidance
• references/workflows.md — weekly verify, monthly drill, pre-change snapshot, CI

Archive model

Default: operational only. Secrets are opt-in via --include-secrets.

Prerequisites

• age for secrets encryption
• gh for GitHub push (optional)

Configuration

Set encryption via environment or flags:

export AGE_RECIPIENT="age1your_public_key"
export AGE_PASSPHRASE_FILE="/path/to/passphrase"

bash {baseDir}/scripts/backup.sh --include-secrets --age-recipient age1...

Safety rules

• Never push secrets unless they are encrypted
• Prefer verify before restore, and dry-run before live restore
• Treat restore as destructive until proven otherwise
• If paths or archive contents are ambiguous, stop and clarify

References

• {baseDir}/references/restore-guide.md
• {baseDir}/references/what-to-backup.md
• {baseDir}/references/retention-policy.md
• {baseDir}/references/workflows.md