Undo the last commit#

You will end up with the router running the configuration it had before your last change. No file, no backup and no reboot are involved: VyOS archives the configuration on every commit, and a rollback loads an archived revision and commits it.

Before you start#

• The operator role, and a licence — a rollback is a write, so an unlicensed router answers 402.
• The router running with its archive intact (/config/archive/).

Know what the numbers mean before you type one:

Step 1 — Find the revision#

From the UI: System → History. Each row is a commit, with who made it and when.

From the API:

R=https://<router>:8443
T=wh_...
curl -sk -H "Authorization: Bearer $T" "$R/api/history"

Step 2 — Read the diff first#

Never roll back to a number you have not looked at.

From the UI: the Diff button on the revision's row.

From the API:

curl -sk -H "Authorization: Bearer $T" "$R/api/history/diff?rev=1"

The + lines exist in that revision and the - lines exist in what is running, so a rollback applies the + side. Read it for the same three things a restore is read for: interface addresses, firewall rules, and service ssh — those are what take your session with them.

Step 3 — Roll back#

From the UI: the Restore button on the revision's row. It asks for confirmation first.

From the API:

curl -sk -X POST -H "Authorization: Bearer $T" -H 'Content-Type: application/json' \
  -d '{"revision":1}' "$R/api/rollback"

An empty body defaults to revision 1, so -d '{}' undoes the last commit.

From the console:

configure
rollback 1

All three do the same thing: load /config/archive/config.boot.<n>.gz and commit it. The VyOS HTTP API has no rollback operation of its own — this is the agent doing what the CLI command does.

What a rollback does not restore#

• Accounts, tokens, two-factor enrolments and the audit log. Those live in state.json, not in a revision. A rollback cannot un-delete a user.
• Container images. Rolling back a revision restores the configuration that named an image; it does not restore the image. Reinstalling last month's app after a bad update gets you today's build of it, because the catalogue's images are floating tags.
• Anything that was never a commit. A change made with configure and never committed, or a file edited by hand, is not in the archive.

Check it worked#

# The running configuration is back
show configuration commands | grep 'the thing you changed'

# And revision 0 is now what you rolled back to; the rollback itself is a commit,
# so the history has one more entry than before, not one fewer.

In the UI, System → History shows the rollback as a new revision. That is correct and worth understanding: a rollback moves forward to a previous state, it does not delete history.

If the rollback fails with a 502#

The archive file for that revision is missing.

ls -l /config/archive

config-management commit-revisions decides how many are kept. The OPNsense importer sets it to 100; the shipped image may differ. To keep more:

set system config-management commit-revisions 200

How many revisions to keep#

Enough to cover the gap between making a mistake and noticing it. A hundred is a reasonable default on a router that changes a few times a week. The archive lives on /config, which is also where the agent's state and your certificates live, so it is not free — but a compressed configuration file is small.

Undoing the undo#

Roll back again. The rollback was a commit, so revision 1 is now the configuration you just left.

See also#

• Revisions and rollback — the model
• Commit-confirm — the automatic version, for a change that might cut you off
• Restore a configuration — when the change you want to undo is older than the archive
• System — history

Checked against agent/main.go · docs/backup-restore.md · docs/deploy.md · docs/apps.md