How does BackupWall licensing work?
One licence key covers one server and is tied to that server's public IPv4 address. The server renews a signed 24-hour lease every 6 hours from the licence service. Licensing fails open: it can pause new backups, but it never blocks restores, downloads or Disaster Recovery, and never deletes anything.
One key, one server
Each licence key is for one server at a time. The licence service ties the key to the public IPv4 address it sees the request come from, to one installation (a random installation id kept in /var/lib/backupwall/license/install-id) and to one machine (a hash of the machine id). Never run one key on two servers at once. A server behind a NAT or gateway is licensed to the gateway's public address, which must stay the same; a cloud server with a public IP mapped to a private one (AWS, Google Cloud, Azure) is fine. A private (10.x, 172.16-31.x, 192.168.x) or carrier-grade NAT (100.64.x to 100.127.x) address cannot activate. Several licensed servers behind one shared public address are untested.
The lease
Activation contacts https://hub.backupwall.com (port 443) once. The service answers with a lease: a signed statement, valid for 24 hours, that this server is licensed. BackupWall checks the signature against a key built into the program, keeps the lease under /var/lib/backupwall/license/, and judges itself from that file. After that the server renews it by itself with a check-in every 6 hours. BackupWall never needs the network to decide whether a backup may run.
What the check-in sends
The key, the random installation id, a hash of the machine id, the build you run, the outcome of your last update attempt, and a check of BackupWall's own program files against the signed release. Nothing about your accounts, backups, destinations or logs.
States
| State | When | What it means |
|---|---|---|
| Licensed | A valid lease. | Everything works. Updates can be offered. |
| Grace | The lease ran out and the service cannot be reached; or the licence lapsed or was suspended; or the key is tied to another address or machine; or a new server has not activated yet. | Everything keeps working for 3 days. The console shows a banner. No updates. |
| Unlicensed | The 3 days are over, the key was revoked (no grace), or the server never reached the licence service. | With enforcement on: no new backup jobs, scheduled and manual backups do not run, migrations are refused on both servers. |
See What happens if your licence lapses.
Enforcement is off in the beta
During the closed beta, licence enforcement is switched off (BACKUPWALL_LICENSING_ENFORCE=0, the default). BackupWall works out the state, shows a banner and logs what it would have refused (licensing.would_refuse), and stops nothing. PortWall will tell beta testers before enforcement is switched on.
The licence and updates
Only a Licensed server is offered updates. A server whose own program files were modified gets no offer either, while its licence and backups carry on. See How updates work.
Check your licence
cd /opt/backupwall && BACKUPWALL_ENV_FILE=/etc/backupwall/backupwall.env /opt/backupwall/.venv/bin/python -m app.licensing status
It reads the saved lease and makes no network call. You want "state": "licensed". Use check-in instead of status to ask the service now.