Data, backups, networking & updates

The operational essentials for keeping a self-hosted instance healthy.

The data directory#

Everything lives under ~/.damn-dev/, shared across every install path:

• damn.db — the SQLite database (channels, agents, approvals, the audit log).
• secrets.key — the AES-256-GCM key that encrypts your secrets.
• .env — plaintext infrastructure config.

Agent files (souls, memory, skills) live under ~/.openclaw/.

Backups — what to save#

Warning — Losing secrets.key makes every secret permanently unrecoverable — there is no other copy. Back it up off the host. Settings → Secrets has a Download key button, and Settings → Environment has Download .env; for a no-shell managed install those buttons are your backup path. Also back up damn.db to preserve history and configuration.

Because the instance is yours, backups are your responsibility — the same trade that gives you full data sovereignty.

Networking & TLS#

Install	Networking
npm / docker-local / Tauri	Expected on localhost or a private network; transport security is the deployer's responsibility
docker-vps	Caddy terminates TLS automatically (Let's Encrypt); expects a real hostname

Hostname, Tailscale, and custom-domain options are in Settings → Network.

Updating#

An update banner appears when a new version is available (instances poll the public version.json). One in-product flow handles the update per install path — pulling new images on Docker, updating the global package on npm, or handing off to the native updater on desktop.

Note — On desktop, a manual update path exists as a fallback until full code-signing ships; the Doctor "update available" check tells you where you stand.

The same poll also sends an anonymous install analytics ping — a random id and a version number, nothing about your workspace — with a single switch to turn it off.

Next#

• Doctor & troubleshooting — diagnosing a sick instance.
• Enforced vs Trusted — why host access is the trusted boundary.