Backup and restore

Everything cerberd can’t rebuild lives in two places:

• /etc/cerberd/ — configuration, token, RouterOS password
• /var/lib/cerberd/<interface>.db — the hub key, peers, keys, reservations, tags

Direct links don’t need a backup: their runtime state is rebuilt from the routers’ tagged objects and wg show on start.

Backup

cerberd db backup wg0 /root/backups/wg0-$(date +%F).db

A consistent copy (VACUUM INTO), safe while the daemon runs. The backup holds private keys: it is created 0600 before anything is written to it, and an existing file is never overwritten. Keep it encrypted off the hub.

Back up /etc/cerberd/ with your usual configuration management.

Restore

systemctl stop cerberd@wg0                    # wg0 keeps forwarding
rm -f /var/lib/cerberd/wg0.db-wal /var/lib/cerberd/wg0.db-shm
install -m600 -o cerberd -g cerberd /root/backups/wg0-2026-10-24.db /var/lib/cerberd/wg0.db
systemctl start cerberd@wg0
cerberd status

On start cerberd reconciles wg0 toward the restored database: peers added since the backup become foreign (kept by default, hub.foreign_peers), peers deleted since come back. If that would remove more than hub.max_removals peers or routes at once, the reconcile is held back and cerberd status says so; nothing is changed until you resolve it.

Rebuild a hub

On a new machine with the same public IP or DNS name:

1. Install cerberd.
2. Copy /etc/cerberd/ back (root:cerberd, 0750 dir, 0640 files).
3. Restore the database as above. The state directory doesn’t exist until the unit first starts, so create it before the install step: install -dm750 -o cerberd -g cerberd /var/lib/cerberd.
4. Recreate the host firewall and ip_forward (cerberd doesn’t manage them).
5. systemctl enable --now cerberd@wg0.

cerberd creates wg0 with the stored hub key, adds every unblocked peer with its last known endpoint, and sets the routes. Clients re-handshake on their next retry (up to about 15 s, as with wg-quick).