Where does BackupWall keep its files, and which services, ports and commands does it use?

Files and folders

What	Where
Program, Python, private job queue, console files	`/opt/backupwall`
Settings and secrets (master key, login secret, queue password, panel credentials)	`/etc/backupwall/backupwall.env` (mode 640, root:backupwall)
Database	`/var/lib/backupwall/backupwall.db` (plus `-wal` and `-shm` while running)
Working space (staging for backups, restores, migrations)	`/var/lib/backupwall/workspace`
Change-tracking caches	`/var/lib/backupwall/statcache`, `bitmaps`, `packindex`
Default local destination folder	`/var/lib/backupwall/backups`
Download files waiting to be fetched (kept 48 hours)	`/opt/backupwall/downloads`
Licence lease and install id	`/var/lib/backupwall/license/`
Updater policy and staging	`/var/lib/backupwall/updates/`
TLS certificate and key	`/etc/backupwall-tls/cert.pem`, `key.pem`
Service logs	`/var/log/backupwall/` (`worker.log`, `download-worker.log`, `beat.log`, `redis.log`, `watchdog.log`)
API and watcher logs	the system journal: `journalctl -u backupwall-api`, `journalctl -u backupwall-watcher`
Watchdog	`/usr/local/bin/backupwall-watchdog.sh`, `/etc/cron.d/backupwall-watchdog`
Disaster Recovery restore tool	`/usr/local/bin/bw-dr-restore` (link `/usr/sbin/bw-dr-restore`)
Support bundle tool	`/usr/local/sbin/backupwall-support-bundle` (link `/usr/sbin/backupwall-support-bundle`)
Standalone extract tool	`/usr/local/bin/bw-extract`
Log rotation	`/etc/logrotate.d/backupwall` (daily, 14 days, compressed; do not edit)
Build stamp (version)	`/opt/backupwall/app/_build.json`
Panel plugin key (WHM and cPanel)	`/var/cpanel/backupwall/service.key`
Panel plugin key (DirectAdmin)	`/usr/local/directadmin/plugins/backupwall/service.key`
Plugin files	`/usr/local/cpanel/whostmgr/docroot/cgi/backupwall`, `/usr/local/cpanel/base/frontend/jupiter/backupwall`, `/usr/local/directadmin/plugins/backupwall`

Services

Unit	What it does
`backupwall-api`	The API and the web console.
`backupwall-worker`	Runs backups, restores and migrations (as root).
`backupwall-download-worker`	Builds download files.
`backupwall-beat`	The scheduler.
`backupwall-watcher`	Notes which files changed.
`backupwall-redis`	The private job queue (unix socket only).
`backupwall-updater.timer`	Every 5 minutes, installs an approved update when the server is idle.
`backupwall-download-proxy.timer`	DirectAdmin only: keeps the `/backupwall-download` proxy set up.

Ports and hosts

Inbound 8087/tcp: the console over HTTPS (self-signed). Panel plugins use 127.0.0.1:8087 over plain HTTP, reachable only from the server.
Ports 80 and 443 on a server with no panel (nginx).
Outbound 443: your destinations, hub.backupwall.com, dl.backupwall.com, release-assets.githubusercontent.com, SMTP or webhook targets you configure, and your other BackupWall servers (port 8087).

Commands

Command	Use
`bash install.sh` / `bash uninstall.sh`	Install, upgrade or remove.
`backupwall-support-bundle`	Collect diagnostics for support.
`bw-dr-restore --bundle FILE [--dry-run]`	Restore BackupWall's own state from a DR bundle.
`bw-extract`	Read a destination without BackupWall.
`python -m app.licensing status \| activate \| check-in \| rebind \| attest --force`	Licence (run from `/opt/backupwall` with `BACKUPWALL_ENV_FILE=/etc/backupwall/backupwall.env` and `.venv/bin/python`).
`python -m app.updates status \| check \| policy \| approve \| rollback`	Updates (run from `/opt/backupwall` with `.venv/bin/python`).
`curl -s http://127.0.0.1:8087/api/v1/health/ready`	Version, build and `dr_configured`.

Settings in `/etc/backupwall/backupwall.env`

The installer writes it once and keeps it on upgrades. Notable settings: MASTER_ENCRYPTION_KEY_B64 (the master key), BACKUPWALL_LICENSE_KEY, BACKUPWALL_LICENSING_ENFORCE (0 in the beta), MYSQL_DEFAULTS_FILE (a [client] options file for a panel-less server), RESOURCE_TIER, RESTORE_CHECK_ENABLED, RESTORE_UNSUSPEND_FOR_API, MALLOC_ARENA_MAX and MALLOC_TRIM_THRESHOLD_. Restart the services after you edit it, while no backup, restore or migration is running.