5.3 Backups and cloud sync
Backups
A backup is a snapshot of the configuration, written beside the database rather than inside it, so it survives the database it was taken from.
Settings → Backups:
- Turn them on, and say how often.
- Where backups live is the directory the snapshots are written to. Point it at a folder Dropbox, OneDrive, iCloud Drive or your NAS already syncs, and every backup is uploaded as it is written.
- The panel names the last backup and the next one, and says so when the last one failed.
- Restore puts one back; Delete removes one.
One snapshot is also taken in front of every import (3.5), so bringing a CC Switch installation over is undoable.
Cloud sync
A copy of every backup, kept somewhere that is not this machine. Settings → Cloud sync:
| Target | Works with |
|---|---|
| WebDAV | Nextcloud, ownCloud, Synology, QNAP and most other NAS firmware |
| S3 | S3 itself, Cloudflare R2, Backblaze B2, MinIO, Aliyun OSS, Tencent COS |
For WebDAV, most services want an app password here rather than the one you sign in with.
The snapshots are immutable files, so a sync has nothing to merge: each side ends up holding what the other had, and any of them can be restored from the list on the Backups panel.
Import and export
Settings → Import and export is the configuration as one file: what to move to another machine, and what to read back from one.
A snapshot carries the providers, the connections, the agents with their routing and permissions, the probe cases, the model prices and the settings — each a section you can leave out. Secrets is the separate tick that decides whether the credentials inside them travel too; a snapshot taken without it describes a configuration nobody can serve traffic with until the keys are typed again.
Connections restored onto another machine are written into that machine's agents with its Gateway port and program path, not the ones they were taken with.
This is the route for setting up a second machine the way this one is set up, where backups are the route for getting this machine back.
Next: 5.4 Docker and Podman.
5.2 Security and serving other machines
Gateway binds 127.0.0.1 by default, because two things are wide open to whoever can reach the port:
5.4 Docker and Podman
Agents are discovered by reading the home directories and install paths of the machine Gateway runs on, and inside a container that is the container's own filesystem. So Agents, Skills, MCP & Prompts and agent monitoring stay empty there — and the pages say so, rather than pretending nothing is installed.