The standalone agent

For a server with no hosting panel to connect to — a virtual machine, a bare-metal box, anything you run yourself. The agent captures on the server, seals the backup to your workspace key, and pushes it out. Everything else on this site pulls; this one pushes.

The agent holds no key that can read a backup back. It can write and it cannot decrypt. That is the point of it: a server that is later compromised cannot be used to read or rewrite its own backup history. The security model sets out what that does and does not protect you from.

Before you start

PHP 8.2 or newer on the server, with the sodium extension. The agent is a single PHAR and needs nothing else installed.
Outbound HTTPS to vault.faciotech.com. Nothing needs to reach the server from outside — no inbound port, no firewall hole, no fixed address.
A workspace you can sign in to, and the paths or database you want captured.

1. Create the source

In your workspace, add a source for the server before you touch the server itself. The enrolment token is issued against that source, so it has to exist first.

2. Issue an enrolment token

On the Agents page, issue a token for that source. It is shown once, it works once, and it expires. If you lose it, issue another — there is no way to retrieve the one you were shown.

3. Install and enrol

Put the PHAR somewhere permanent on the server, then run the command the workspace showed you. It looks like this:

faciovault-agent.phar enroll \
  --url=https://vault.faciotech.com \
  --token=<the one-time token> \
  --config=/etc/faciovault/agent.json

On success it prints the install id and writes the config file. That file now holds the credential this install authenticates with, so it belongs to root and nobody else:

chown root:root /etc/faciovault/agent.json
chmod 600 /etc/faciovault/agent.json

4. Run a backup

Files, a database, or both in one run. Every flag after --config is optional and you use the ones that apply:

faciovault-agent.phar backup \
  --config=/etc/faciovault/agent.json \
  --files=/var/www \
  --db-dsn="mysql:host=127.0.0.1;dbname=app" \
  --db-user=backup \
  --db-pass=<password>

Use a database user that can read and nothing else. Everything the connectors page says about narrow, revocable credentials applies here too — see what each connector needs.

5. Put it on a schedule

The agent does not schedule itself. Run it from cron at whatever interval your plan allows:

# nightly at 02:15, and a heartbeat every fifteen minutes
15 2 * * *   /usr/local/bin/faciovault-agent.phar backup --config=/etc/faciovault/agent.json >> /var/log/faciovault-agent.log 2>&1
*/15 * * * * /usr/local/bin/faciovault-agent.phar heartbeat --config=/etc/faciovault/agent.json >/dev/null 2>&1

The heartbeat is not decoration. A schedule that quietly stops firing is the failure that hides for months, so the platform watches for an install whose window has elapsed with no successful backup and tells you. Without the heartbeat, a server that has gone silent looks the same as one with nothing to send.

6. Check it worked

The source appears in your workspace once the first run lands, with its most recent restorable point — not its last attempt. A backup only counts once it has been restored into a sandbox and checked against what was captured. Until then it is an upload, not a backup.

7. Restore

Start the restore from your workspace. The agent picks it up on its next poll and carries it out:

faciovault-agent.phar restore \
  --config=/etc/faciovault/agent.json \
  --files=/var/www

Restore somewhere harmless first, before you need it for real. A restore you have never run is a plan, not a backup.

Updates

The agent has an update command, and it verifies a signature before it will replace itself:

faciovault-agent.phar update --config=/etc/faciovault/agent.json

Being straight about where this stands today: the platform is configured to verify signed releases, and no signed release has been published yet. Until one is, update has nothing to fetch and will decline rather than install anything unsigned. That is deliberate — an agent that accepts an unsigned build is an agent anyone who reaches the download can replace. Update by putting a new PHAR in place yourself for now.

What it can and cannot do

Can read the paths and databases you point it at, and send sealed backups out.
Cannot decrypt anything, list your other backups, or reach any workspace but the one it enrolled into.
Cannot be reached from outside. It makes outbound requests only; there is no listening port.
Revoke an install from the Agents page at any time. It stops being able to send immediately, and the backups it already made are unaffected.

If something goes wrong

Enrolment refused. The token is one-use and time-limited. Issue a fresh one rather than retrying the old one.
A run fails. The previous verified point still stands. Nothing overwrites a good copy, and a failed run never shortens your history.
Nothing arrives and no error appears. Check outbound HTTPS from the server. The agent cannot report a problem it cannot reach us to report, which is the reason for the heartbeat.

Beyond that, the help page has the Support Centre, the knowledge base and how to open a ticket.