How do I install BackupWall?

Before you start

You need root, a supported Linux server (System requirements) and your licence key. The install works without a key, but a licence banner shows and the server gets no updates.

Install from the release tarball

Put the tarball and its checksum file in one folder, for example backupwall-0.9.0-beta.1-v278.tar.gz and backupwall-0.9.0-beta.1-v278.tar.gz.sha256.
Check the file. It must print OK; if it does not, stop and ask for the file again.
```
sha256sum -c backupwall-0.9.0-beta.1-v278.tar.gz.sha256
```

Unpack it and go into the folder.

tar xzf backupwall-0.9.0-beta.1-v278.tar.gz
cd backupwall-0.9.0-beta.1-v278

Run the installer and keep the log.
```
bash install.sh --license-key YOUR-LICENCE-KEY 2>&1 | tee /root/backupwall-install.log
```
On a shared server pass the key as LICENSE_KEY=YOUR-KEY bash install.sh instead, because a command-line key is visible in the process list while the installer runs. A key may contain only letters, digits and . _ : / + = -.

On Ubuntu and Debian the installer waits up to 10 minutes if another apt process holds the package lock. That is normal on a fresh cPanel server.

Install with the one-line installer

With a licence key you can download, verify and install the current release in one command. The installer's address is provided with your beta invitation (it is not public yet). Check the installer's SHA-256 against the value published next to it first.

curl -fsSL <installer address from your invitation> | bash -s -- --key YOUR-LICENCE-KEY

The installer asks the licence service for the release files, checks their signature against a key built into the installer, and runs the release's own install.sh. It needs root, curl, sha256sum and Python 3 with the cryptography module, and outbound HTTPS to hub.backupwall.com, dl.backupwall.com and release-assets.githubusercontent.com. Leave --key out to be asked for the key without it being shown, or set BACKUPWALL_LICENSE_KEY.

What the installer does

It installs the packages it needs, puts a private Python 3.11 in /opt/backupwall/python, creates the backupwall system user, installs the program and the prebuilt console, generates the master encryption key and the other secrets, creates a scoped and revocable credential for the local panel (a WHM API token on cPanel, a login key on DirectAdmin, a secret key and a MySQL user on Plesk), creates the database and the admin user, sets up a private job queue on a unix socket, creates a self-signed TLS certificate, and installs and starts six services plus a watchdog that checks them every 5 minutes. It does not install the panel plugins; see Install the panel plugins.

Save two things from the final output

Web interface:   https://<server-ip>:8087
TLS fingerprint: <value>
Admin login:
  Username:  admin
  Password:  <20 random characters>

The admin password is printed once. Nothing shows it again, and there is no password-reset command. Save it in a password manager now, then delete /root/backupwall-install.log, which contains it.
The TLS fingerprint identifies this server when you link it to another BackupWall server for migration. Settings → Peering shows it too.

On a cloud server the installer prints the public IP if it can read it from the cloud's metadata service. If it says "(a PRIVATE address)", use the server's public IP from your cloud console, and open port 8087 in the cloud firewall as well.

Installer settings

Everything beyond --license-key and --help is an environment variable, and variables are not remembered between runs.

Variable	Default	Meaning
`BW_PORT`	`8087`	Port of the API and console. Leave it alone: the panel plugins use 8087.
`BW_TLS`	`on`	`off` serves plain HTTP on the public port. Do not use it.
`DOMAIN`	empty	Servers with no panel only: asks Let's Encrypt for a certificate.
`BUNDLE_PYTHON`	`true`	`false` uses a Python 3.11 or newer already on the server. The plugin installers need Python 3.11.
`PBS_LOCAL_TARBALL`	empty	Path to a pre-downloaded Python archive, for servers with no internet.
`INSTALL_NGINX`	`auto`	Panel servers never get nginx. `false` skips it on a server with no panel.
`BW_WORKER_CPU_QUOTA`, `BW_WORKER_CPU_WEIGHT`, `BW_WORKER_IO_WEIGHT`	all cores but one; weights 40	CPU and disk limits of the backup service.

Check that it works

systemctl list-units 'backupwall*' --no-legend --no-pager
curl -s http://127.0.0.1:8087/api/v1/health/ready

You should see six units, all active running, and {"status":"ok","version":"0.9.0-beta.1","build":"v278", ...}. If something is wrong, see The console will not open or a service is down.

Next steps

Sign in and secure the console.
Set up Disaster Recovery. Do this before you rely on any backup.
Run your first backup and test restore.