A backup belongs somewhere else.

Your family’s phone setup is worth keeping: the contacts you collected, the rules you chose, and the messages you saved. A backup gives you a way to bring those things to a replacement brain if the original stops working.

Free accounts include zero Doorman-hosted backups. You can still make your own encrypted backups with the Doorman command-line tool, or CLI. You choose where the files go and look after them yourself.

The most important part is the destination. A backup on the brain’s own disk or SD card disappears with that disk or card. Save another copy on a different computer, an external drive, or storage you control in the cloud. A separate folder on the same disk is not a separate copy.

Before you begin

These steps are for the person who manages your brain’s Linux installation. Open a terminal in the Doorman installation directory containing its .env file, using the account that manages that installation. The examples assume the standard doorman service user. A customized installation may use a different user or paths.

Doorman makes a sealed backup bundle containing configuration, phone data, and included recordings. Excluded content stays excluded; check the bundle’s manifest when you verify it.

1. Save your recovery key

For a first-time setup, run:

doorman backup init

This saves the public encryption key in the configuration and prints the private recovery key once. Save that private key in a trusted password manager or another secure place away from the brain. Keep a second protected copy you could reach if your usual computer or password manager were unavailable.

Already configured? Keep the existing key. Do not replace it to follow this guide: older backups still need the key that originally protected them.

Read why your recovery key needs its own safe home.

2. Choose a destination

Edit the installation’s .env file:

sudo -u doorman nano .env

Set BACKUP_PATH to your backup directory. For example:

BACKUP_PATH=/mnt/backups/callmemaybe

That path is an example, not a guarantee of separate storage. Confirm that your intended external drive or network share is actually mounted there and that the doorman user can write to it. Otherwise you may be writing to the brain’s own disk.

If you first write backups locally, arrange to copy the encrypted files elsewhere after each run. Keep dated copies so an unwanted change does not immediately replace every useful backup. The CLI also supports configured S3-compatible storage; see the backup runbook for installation details.

3. Make a copy, then check it

sudo -u doorman doorman backup run
doorman backup list

Check the command’s result and confirm that the bundle exists at your intended destination. Listing a filename alone does not prove you can recover it.

To check that your saved private key opens the newest bundle at the configured destination:

BACKUP_IDENTITY_FILE=~/callmemaybe.key doorman backup verify

Replace ~/callmemaybe.key with the path to your securely stored key file, readable only by the account running verification. This checks the encrypted bundle and displays its manifest without restoring over the running phone. Do not leave your only key copy on the brain after testing.

4. Make it a habit

For the standard Linux service installation, enable the nightly backup timer after configuring the key and destination:

sudo doorman init services
doorman check

Check periodically that recent backups are reaching the separate destination, and verify again after changing storage or keys. For a fuller recovery rehearsal on a spare system, follow the runbook’s restore instructions; restoring is a separate operation that can replace files.

A drive beside the brain protects against a failed SD card, but both could still be lost together. An additional copy away from home protects against that shared loss.

Your three things to keep: a recent encrypted backup, its private recovery key, and a way to find both when the original brain is gone. Hosted backups and recovery-key protection are planned for Basic and Plus; until those services launch, your own copies remain your responsibility.