Recovery kit and master key

What a recovery kit is

A recovery kit is a file that lets you bring up the data without the panel: if the panel is broken, its server is lost, or you're restoring a server on a new machine.

Inside:

• the panel address;
• storages: endpoint, region, bucket, prefix;
• S3 keys: the storage key in “One for all servers” mode, or the server keys in “Each server has its own” mode;
• all servers that have repositories — including disconnected ones whose backups are still in the storages;
• their repository addresses and restic passwords.

The panel master key is not in the kit.

How to get it

“Settings” → “Recovery without the panel” → “Recovery kit” → “Download” or “Save again”:

1. Enter the panel password: the kit holds every key, so an open session isn't enough.
2. Set a password for the file, at least 12 characters. The file is encrypted with it. The panel doesn't keep this password, and it can't be recovered.
3. The file arcula-recovery-kit-<date>.age is downloaded.

The panel doesn't keep the file itself. Each download is recorded in the log of every storage in the kit — “Recovery kit exported”, with the IP and browser.

Where to keep it

Offline, with you:

• the file — on your own computer, in a protected folder. Not on the servers or in the backup storages: the kit is needed exactly when they are gone;
• the file password — in a password manager, e.g. KeePass.

After each download the panel shows the “Where to keep the recovery kit” window with these steps.

The kit holds the keys to all storages and the passwords of all repositories. Whoever has the file and its password has all the backups.

When the kit becomes outdated

The kit is a snapshot as of when it was issued. It becomes outdated when what's in it changes:

• you connected a storage or replaced its key;
• you set or replaced a server key in “Each server has its own” mode;
• a new repository appeared — you confirmed a new server's plan or added a storage to a plan.

Then settings show the kit as “outdated”, and the servers page shows “The recovery kit is outdated: storages or keys have changed since.” with a “Save →” link. Download the kit again and replace the old file with it. If the kit has never been saved — “The recovery kit isn't saved: without it the data can't be restored if the panel is gone.”

How to use it

Check the file:

sudo arcula kit verify ./arcula-recovery-kit-2026-10-24.age

Restore:

sudo arcula restore --kit ./arcula-recovery-kit-2026-10-24.age

Another server's backup can be brought up only with the kit: the agent has no access to other servers' repositories. Without arcula, the file opens with age -d: inside is JSON with the keys and passwords, and with them plain restic can bring up the data too.

Panel master key

The master key is the key the panel uses to encrypt the secrets in its database:

• S3 keys of storages and servers;
• restic repository passwords;
• the Telegram bot token, webhook URLs and signing keys.

It is kept outside the database: in a file, an environment variable or Vault. The panel doesn't show the key itself — only where it is: “Settings” → “Panel master key”, e.g. “file /run/secrets/arcula_master_key”.

Why save it. The panel database is backed up by arcula too. If the panel has to be brought up from a backup of its database, the secrets in it can't be opened without the master key: the panel will start, but won't be able to work with storages, give plans to agents, build a kit or send notifications. You'd be left restoring data with the kit — without the panel.

What to do:

1. Copy the key from where it's kept into your password manager — next to the kit password.
2. Click “I've saved it” in settings: the reminder on the servers page goes away.

The master key together with the panel database opens all storages. Keep a copy only offline, in a password manager.