OpenClaw Cloud Backup

Back up OpenClaw configuration locally, with optional sync to S3-compatible cloud storage.

Requirements

Local backups:

• bash, tar, jq

Cloud sync (AWS S3, Cloudflare R2, Backblaze B2, MinIO, DigitalOcean Spaces):

• aws CLI v2 — required for upload/download/list/restore from cloud

Optional:

• gpg — for client-side encryption

References

• references/provider-setup.md — endpoint, region, keys, and least-privilege setup per provider
• references/security-troubleshooting.md — security guardrails and common failure fixes
• references/local-config.md — optional local settings (paths, retention, behavior)

Setup

Secrets are stored in OpenClaw config at skills.entries.cloud-backup.*:

bucket              - S3 bucket name (required)
region              - AWS region (default: us-east-1)
endpoint            - Custom endpoint for non-AWS providers
awsAccessKeyId      - Access key ID
awsSecretAccessKey  - Secret access key
awsProfile          - Named AWS profile (alternative to keys)
gpgPassphrase       - For client-side encryption (optional)

Agent-assisted setup (recommended)

Tell the agent:

"Set up cloud-backup with bucket my-backup-bucket, region us-east-1, access key AKIA... and secret ..."

The agent will run gateway config.patch to store credentials securely.

Manual setup

# Store secrets in OpenClaw config
openclaw config patch 'skills.entries.cloud-backup.bucket="my-bucket"'
openclaw config patch 'skills.entries.cloud-backup.region="us-east-1"'
openclaw config patch 'skills.entries.cloud-backup.awsAccessKeyId="AKIA..."'
openclaw config patch 'skills.entries.cloud-backup.awsSecretAccessKey="..."'

# For non-AWS providers, also set endpoint:
openclaw config patch 'skills.entries.cloud-backup.endpoint="https://..."'

Local settings (optional)

For non-secret settings (paths, retention), see references/local-config.md and copy the config block to ~/.openclaw-cloud-backup.conf.

Verify setup

bash "{baseDir}/scripts/openclaw-cloud-backup.sh" setup
bash "{baseDir}/scripts/openclaw-cloud-backup.sh" status

Commands

Workflow

1. Run setup to configure credentials (via agent or manually).
2. Run status to verify everything is connected.
3. Run backup full for first backup.
4. Confirm with list.
5. Daily backups are scheduled automatically on first run (see Scheduling).
6. Restore with restore <name> --dry-run first, then without --dry-run.

Scheduling