Take a backup that is actually complete#

You will end up with one encrypted file, kept off the router, that restores it: the configuration with every secret in it, the accounts and their passwords, the two-factor secrets, the API tokens, the licence and the web interface's certificate.

The important sentence first. The configuration file is not a backup. Download configuration in the System page header saves the router's configuration and nothing else. The accounts, tokens, two-factor enrolments and licence live beside the configuration, in the agent's data, so a router restored from the configuration alone works and nobody can sign in to it.

Before you start#

The admin role and a licence. Backup appears in the navigation for admins only, and without a licence its buttons are disabled with the reason Backups need a licence. Enter a licence key under Admin → Licence.
A passphrase of at least 12 characters, and somewhere safe to keep it. It encrypts the file, it is not stored anywhere, and it cannot be recovered: a backup whose passphrase is lost cannot be restored.
Somewhere to keep the file with the same access control as the router itself.

Step 1 — Take it#

System → Backup, panel Take a backup.

Enter the passphrase in Passphrase, and again in Passphrase again.
Press Download backup.

The router collects the backup in memory, encrypts it, and the browser saves it as wheelhouse-<host name>-<date and time>.whbk. The unencrypted contents are never written to the router's disk. The panel then shows Last backup: when it was taken and by whom, the file name, its size and its SHA-256.

The audit log records it as Downloaded a backup.

Step 2 — Check it#

Compare the file you saved with the SHA-256 under Last backup:

bash

sha256sum wheelhouse-edge-20260918T031500Z.whbk

On Windows, Get-FileHash gives the same digest. The same digest means the file on your disk is the file the router wrote.

That proves the copy, not the restore. The check that proves the whole chain is to restore the file once onto a spare machine or a virtual machine and sign in with a real account. Rebuild a dead router onto a new box covers it.

Step 3 — Keep it off the router#

The file is encrypted, and it is still the whole router: whoever has the file and the passphrase has every password hash, key and secret in it. Keep the file and the passphrase apart, and keep the file somewhere other than this router.

Take one before every upgrade and before every large change, as well as on a schedule.

What a backup contains, and what it leaves out#

The page lists both, under What a backup contains and What it does not contain, before anything is taken. In short:

In the backup	Left out
The configuration, unredacted, in the router's own format and as commands	The audit log. The last 500 entries travel for reading only and are never written back.
Every account and its password hash, two-factor secrets, the hashes of unused recovery codes, API token hashes, live sessions and the agent settings	Traffic and host history, which the router rebuilds by watching
The licence key and the licence identity seed, so a restored router keeps its seat	Agent packages downloaded for an update, packet captures and caches
The web interface's certificate and its private key, so browsers that trust this router still trust the restored one	The first-boot password and the record of an update that has finished
The update settings, the UPnP settings, the desired-state file, the installer's commands, the git export settings and key, and the management address	Snapshots

Snapshots, on the router#

The Snapshots panel lists the last 7 snapshots of the configuration and the agent's data: one a day (Daily), one before every restore (Before a restore), and any taken with Take snapshot (Taken by hand). They are kept on the router and are not encrypted, in the agent's data directory, which only root can read.

A snapshot is not a backup: it is on the disk it would protect against. It is the way back from a mistake in the accounts, tokens or settings, which a configuration revision does not carry. For the configuration alone, the History tab of the System page restores any earlier revision: Undo a change. Restoring a snapshot is in Restore a backup.

On a schedule#

The router takes a snapshot every day, but nothing sends a backup off the router by itself. Run the backup from another machine on a timer, with an admin API token:

cron

# 03:15 daily, on the backup host
15 3 * * *  curl -sk -X POST -H "Authorization: Bearer $WH_TOKEN" \
  -H 'Content-Type: application/json' -d "{\"passphrase\":\"$WH_PASSPHRASE\"}" \
  https://edge:8443/api/backup > /backups/edge-$(date +\%F).whbk

POST /api/backup takes the same backup as the button: admin only, and it needs a licence. Issue a token for automation.

When the web interface is not available#

The Backup page needs a running agent. On a router whose agent will not start, a copy of the router's persistent partition taken at the console is the fallback:

bash

sudo tar -czf /tmp/wheelhouse-$(hostname)-$(date +%F).tgz -C / config

That archive is not encrypted. Encrypt it (age -p, or gpg --symmetric) before it leaves the router, and delete the plain copy. Locked out of the UI covers why an agent will not start.

The configuration on its own#

Useful for comparing, for version control, and for --check-against. It is not a backup.

Download configuration, in the System page header, saves <host name>-config.boot. Admin only, because the file is unredacted.
Git export, on the System page's History tab, pushes the configuration to a git remote each time changes are applied. Secrets are redacted before it is pushed, so it is a record of what changed, not a file to restore from. System — history.
For automation, GET /api/config/raw answers with the same file as Download configuration, and GET /api/config/commands with the configuration as commands. Below the admin role both are redacted.

A support bundle is not a backup#

Download support bundle on the Support page produces one file describing this router, for somebody investigating a problem. It is redacted and leaves out the accounts and every secret, so nothing can be restored from it. Support.

What is missing#

No off-router destination. No SFTP, S3 or similar target, and no built-in schedule for one. Use the API from another machine, as above.
A factory reset backs nothing up first. System → Overview → Factory reset, or wheelhouse-rescue factory-reset at the console, wipes the agent's data and runs first boot again, keeping the licence key by default. It backs nothing up first and it is not a secure erase: it unlinks files rather than overwriting them, and it revokes nothing another system already holds, such as an audit log on a syslog collector or a deploy key on a git remote. Locked out of the UI.
No self-service licence release when a router is retired. Rebuild a dead router explains what that costs.

Undoing it#

Delete the file securely: shred -u on Linux, or whatever your storage offers.