openclaw-migrate

Backup, restore, and migrate OpenClaw installations between machines.

Quick Start

Restore from backup

# Download the restore script
curl -sLO https://raw.githubusercontent.com/seans-openclawbot/openclaw-migrate/main/restore.sh
chmod +x restore.sh

# Restore (works on a fresh machine — installs Node + OpenClaw if needed)
bash restore.sh /path/to/openclaw-backup.tgz

Create a backup

curl -sLO https://raw.githubusercontent.com/seans-openclawbot/openclaw-migrate/main/openclaw-migrate.sh
chmod +x openclaw-migrate.sh

# Hot backup (gateway stays running — cron-safe)
./openclaw-migrate.sh backup

# Cold export (stops gateway first)
./openclaw-migrate.sh export

Migrate to another machine

# One-shot: export → scp → install → import on remote
./openclaw-migrate.sh push user@newhost --encrypt

What Gets Migrated

Everything inside ~/.openclaw/ (or $OPENCLAW_STATE_DIR):

• Gateway config and API keys
• Session history and agent state
• Channel state (Telegram, WhatsApp, Signal, Discord)
• Cron jobs
• Workspace files (MEMORY.md, SOUL.md, skills, etc.)
• External workspace (auto-detected if configured outside state dir)

Commands

Command	Description
backup	Hot backup — gateway stays running
export	Cold export — stops gateway first
import <archive>	Restore from a .tgz or .tgz.gpg archive
push <user@host>	One-shot migration over SSH
verify	Post-migration health check

Options

Flag	Description
--encrypt	GPG-encrypt the archive (symmetric passphrase)
--slim	Skip session history (smaller archive)
--no-restart	Don't restart gateway after export
--insecure	Allow push over public networks without encryption
-o FILE	Custom output path

Scripts

restore.sh

Minimal one-command disaster recovery:

1. Installs Node.js (via nvm) if missing
2. Installs OpenClaw if missing
3. Backs up any existing ~/.openclaw/ state
4. Extracts the backup archive
5. Hardens file permissions
6. Runs openclaw doctor
7. Starts the gateway

openclaw-migrate.sh

Full migration toolkit with network security, encryption, checksums, and audit logging.

Security

• Network enforcement: Push over public IPs requires --encrypt or --insecure. Tailscale and private network IPs are trusted automatically.
• Permission hardening: Secrets → 600, sensitive dirs → 700 after extraction.
• Secure cleanup: Temp files and decrypted archives are shredded (shred -u), not just deleted.
• Archive integrity: SHA-256 checksum sidecar generated on export, verified on import.
• Archive age: Warns if importing a backup older than 30 days (credentials may have rotated).
• Audit trail: All operations logged to ~/.openclaw/migration-audit.log.

Environment

Variable	Description
OPENCLAW_STATE_DIR	Override state directory (default: ~/.openclaw)
OPENCLAW_PROFILE	Use a named profile (state dir becomes ~/.openclaw-<profile>)

Compatibility

• Linux and macOS
• No bash 4+ features required
• Non-interactive mode for cron/scripts

License

MIT