Backup & Restore

Phantom-WG provides the ability to back up databases containing user-portable values and exports them into a portable .tar archive. The archive consists of three files:

Manifest

Export

Loading Diagram

Please wait...

WAL-Safe Export

SQLite Online Backup API is used. Exports can be performed safely while the daemon is running — no database locks are acquired.

Import

Loading Diagram

Please wait...

Preview

Before import, manifest data is displayed to the user:

Export Backup

Download the current daemon state as a portable archive.

phantom-backup-2026-03-18.tar

48.2 KB

FieldValue

Subnet

10.8.0.0/24

Clients

12 / 253

Exit Servers

Timestamp

2026-03-18T10:23:45.123456+00:00

Validation Layers

The backup file goes through two-stage validation before reaching the daemon — first on the SPA side, then on the daemon side:

Browser-Side Validation (SPA)

Check	Rule
Extension	`.tar`
Size	Max 64 MB
Tar structure	`wallet.db`, `exit.db`, `manifest.json` present
Manifest	Valid JSON, `version: "1.0"`

Server-Side Validation (Daemon)

Check	Rule
Tar whitelist	Only `wallet.db`, `exit.db`, `manifest.json` — extra files are rejected
Path traversal	Paths like `../../` are blocked
Manifest version	Invalid version is rejected
PRAGMA integrity_check	Integrity check for both databases
Schema validation	Required tables and columns are verified

Import replaces all existing state.

The import operation completely replaces wallet.db and exit.db. WireGuard state is automatically re-synced after the operation. If an active multihop connection exists, it is torn down first.