Question 1

How does VaultDBM perform zero-lock database snapshots without blocking traffic?

Accepted Answer

VaultDBM utilizes MySQL single-transaction mode combined with quick streaming. For InnoDB tables, snapshots are captured as a point-in-time consistent view without holding global read or write table locks, ensuring active web users experience zero performance slowdowns.

Question 2

What compression algorithms are used for backup dumps?

Accepted Answer

VaultDBM supports real-time gzip stream compression (.tar.gz). Dumps are compressed on-the-fly as they are read from MySQL, reducing server storage overhead by up to 85% without writing uncompressed raw dumps to disk.

Question 3

Is my database content encrypted before being sent to AWS S3 or Google Cloud Storage?

Accepted Answer

Yes! VaultDBM performs client-side AES-256-GCM encryption on your local server BEFORE any archive is uploaded. Your cloud storage provider only receives encrypted ciphertext (.enc files). Decryption is impossible without your master server key.

Question 4

Can I send backups to multiple destinations simultaneously?

Accepted Answer

Absolutely. You can configure simultaneous uploads to AWS S3 (and S3-compatible providers such as Wasabi, MinIO, Cloudflare R2 and Backblaze B2), Google Cloud Storage, Azure Blob Storage, remote SFTP servers, and NFS or local NAS storage arrays in parallel.

Question 5

Why does Nginx require the X-Real-IP header configuration?

Accepted Answer

Without X-Real-IP, the Node.js backend would see all requests originating from 127.0.0.1. If an attacker attempts to brute force your login portal, passing the true client IP ensures our automated rate-limiter jails only the attacker rather than blocking legitimate users.

Question 6

What happens when an IP address gets jailed?

Accepted Answer

If an IP address fails authentication more than 5 times within a 5-minute window, the IP is automatically placed into an isolation jail for 15 minutes. High-volume attacks will trigger permanent IP blacklisting.

Question 7

How is an update applied without risking the installation?

Accepted Answer

Nothing is overwritten until the package has proved itself. The archive is checked for a real ZIP signature, its SHA-256 is verified against the published digest, and it is extracted to a staging area where the required files must be present and the entry point must pass a syntax check with the same Node binary that will run it. Only then is every file the update would replace copied into update-state/backups/ and the new version written over the installation.

Question 8

What happens if the new version fails to start?

Accepted Answer

The installation rolls itself back. Applying an update writes a marker recording which backup belongs to it, and each start increments a boot counter. If the new version has not started cleanly within 2 attempts, the previous version is restored from its backup automatically on the next start. The three most recent update backups are retained, so a rollback is always available.

Question 9

Will an update overwrite my licence or my configuration?

Accepted Answer

No. The release package deliberately excludes config/license.json and config/installed.lock, so an activated machine stays activated and the setup wizard does not run again. Your .env file is never included either, which means database credentials, encryption keys and CORS settings survive every update untouched.

Question 10

Why must I raise client_max_body_size in Nginx before updating?

Accepted Answer

A release package is roughly 16 MB and the Nginx default body limit is 1 MB, so the upload is rejected before it ever reaches the application. The rejection usually surfaces in the browser as a generic network error rather than a clear message, which makes it easy to misdiagnose. Set client_max_body_size to 50M on the proxy, as shown in the deployment guide.

Question 11

Is there an offline update path for air-gapped servers?

Accepted Answer

Yes. Any release can be downloaded as a .zip from the Downloads page and applied through Manual Update in the admin console, with no outbound connection required at install time. The same verification runs on an uploaded package as on a downloaded one, and you may supply the published SHA-256 so it is enforced rather than merely recorded.

Question 12

Does VaultDBM need to reach a licence server to keep running?

Accepted Answer

Not for day-to-day operation. Each licence is issued as an Ed25519-signed certificate, and the product verifies that signature locally using a public key embedded in the package at build time. Revalidation is scheduled rather than constant, so a temporary loss of connectivity to the licence server does not stop backups from running.

Question 13

What happens when a licence is expired, revoked or missing?

Accepted Answer

That is governed by the enforcement mode. The default, report, logs the violation and still serves the request, so an operator can see exactly which installations would be affected before enforcing anything. Switching to block refuses licensed endpoints with HTTP 402. In both modes activation, setup, authentication and health checks stay reachable, because an unlicensed installation must always have a route to becoming licensed.

Question 14

How do I move a licence to a different machine?

Accepted Answer

Use Release Node in the admin console. It requires your administrator password and the exact company name on the licence, then asks the platform to free the seat and only clears the local certificate once the platform confirms. That order matters: clearing the certificate first would leave the seat consumed and the machine unable to work, while decommissioning without clearing would let the machine silently re-claim the seat at its next revalidation.

Question 15

Is there a separate Windows installer?

Accepted Answer

No. One cross-platform .zip serves both platforms. It contains start.sh and start.bat, which install production dependencies if missing, launch the server, and relaunch it after an update requests a restart. Windows 10 1803 and later include tar, so no additional tooling is needed to extract the archive.

Question 16

Which settings must be configured before the first start?

Accepted Answer

In production the application refuses to start until the environment is complete: NODE_ENV, APP_PORT, the five DB_ variables, DB_CONNECTION_LIMIT, a JWT_SECRET of at least 32 alphanumeric characters, a 64-character hexadecimal ENCRYPTION_KEY and BACKUP_ENCRYPTION_KEY, and CORS_ORIGIN listing every address the interface will be opened on. Node.js 24 or later is required.

Question 17

What is the Encryption Recovery Key, and why should I create one?

Accepted Answer

It is your insurance against losing the keys that protect your data. Your encryption keys seal every stored secret and every backup archive, and they live in your server environment rather than with us. If that environment is rebuilt, migrated or lost, the keys go with it and your encrypted backups can no longer be read. Generating a Recovery Key from Settings, under Security and Encryption, places a sealed copy of those keys in escrow so they can be restored later. Create one when you first configure the server, not after something has gone wrong.

Question 18

How should the Recovery Key be stored, and is emailing it safe?

Accepted Answer

The Recovery Key is never sent or stored in plain text. When you choose to have it emailed, it is attached as a file encrypted with a passphrase that you set, so the message alone is useless to anyone who reads your mailbox. That protection only holds if the two halves are kept apart: store the file and the passphrase in different places, and never in the same inbox, password manager entry or document. Keep at least one copy offline and away from the server it protects, since a Recovery Key sitting on the machine it would be used to rebuild protects nothing. Choose a strong passphrase; the file can be attacked offline by anyone who obtains it.

Question 19

What happens if I lose both the Recovery Key and my encryption keys?

Accepted Answer

The encrypted backups cannot be recovered, by you or by us. There is no master key, no escrow held on our side and no support process that can reverse it, because a vendor able to decrypt your archives on request would be a weakness rather than a convenience. This is deliberate, and it is the reason the product asks you to create a Recovery Key early and to store it separately from the passphrase that protects it. If your keys are intact but you are planning a migration or a key rotation, generate a Recovery Key first, while the current keys are still available.

Question 20

Why must ENCRYPTION_KEY be set before saving the first connection?

Accepted Answer

Every stored secret is sealed with it, including database passwords, SMTP credentials and two-factor secrets. If the key changes afterwards none of them can be decrypted, and the application reports that it cannot authenticate the data. Set it once, before any credential is saved, and keep it safe. If it ever must be rotated, retain the previous value and re-encrypt the stored credentials while it is still available.

Question 21

The administrator has lost their authenticator app. How is two-factor reset?

Accepted Answer

Another administrator can clear it from Users in the console: select the user and choose Reset 2FA. The account then signs in with its password alone and enrols a new authenticator from Settings. When the locked-out account is the only administrator there is nobody left to do that, so the reset moves to the server console: run node scripts/reset2FA.js --username admin in the installation folder, then sign in with the password and re-enrol. Running it there is deliberate: shell access on the server is a far stronger claim than reaching a web page, which is the same reasoning that puts password resets in seedAdmin.js. Nothing else is altered, not the password, not the role, and not any other account.

Question 22

After reinstalling, sign-in says the two-factor setup needs to be reset. What happened?

Accepted Answer

A fresh installation generates a new ENCRYPTION_KEY. Pointed at a database from the previous installation, nothing encrypted with the old key can be read, and the stored two-factor secret is one of those things, so the login is refused before the code is even requested. Two-factor is only the first symptom: database connection passwords, storage target keys and SMTP credentials are sealed with that same key and will also be unreadable. Before clearing anything, look for a surviving copy of the old .env. Restoring its ENCRYPTION_KEY recovers everything at once and no reset is needed, whereas clearing two-factor recovers the ability to sign in and nothing more.

Question 23

How is a forgotten administrator password reset?

Accepted Answer

From the server console: node scripts/seedAdmin.js --username admin --reset-password. A new password is generated and printed once, so record it before closing the terminal; pass --password to choose one yourself, keeping in mind that it then lands in shell history. The reset also lifts any login lockout and re-enables the account, and leaves the email, display name and role untouched. Without that flag the same script creates the administrator only if one is missing and otherwise changes nothing, so it is safe to re-run during an install or upgrade. Passwords are stored as bcrypt hashes in the database and nowhere else: earlier releases also kept a copy in .env, which silently reverted any password changed in the console, and that has been removed.

Frequently Asked
Questions & Technical Clarifications

Still Have Technical or Architecture Questions?

Frequently Asked Questions & Technical Clarifications

Still Have Technical or Architecture Questions?

Frequently Asked
Questions & Technical Clarifications