Reference
Backups & Offline
Plan recovery around Git-backed encrypted state, separately protected private identities, automatic env-file backups, and the limits of an offline local-first system.
Repository backup
Ghostable has no separate hosted vault to restore from. The Git repository is the durable copy of encrypted values, public devices, policy, access grants, environment keys, schema, hygiene configuration, and signed events. Protect it with the same remote redundancy and retention used for source code.
A repository backup alone preserves ciphertext and history, but it cannot decrypt values without at least one still-authorized private device identity or automation credential.
Identity recovery
Private device identities live outside Git. Maintain more than one owner device so the project is not dependent on a single laptop. If all authorized private identities and automation credentials are lost, public device records and encrypted repository state cannot reconstruct the missing private keys.
Env-file backups
env pull merges by default and creates a timestamped .ghostable-backup-<timestamp> copy before overwriting an existing file. Disable that behavior only with --no-backup.
Local deploy replaces its target by default and creates a backup only when --backup is passed. Dry runs never write a backup because they do not write the destination.
$ ghostable env pull --env default --file .env --dry-run
$ ghostable env pull --env default --file .env
$ ghostable deploy local production --file .env.production --backup
Offline behavior
Setup, encryption, decryption, validation, review, hygiene, local process injection, and repository state changes run locally and do not require a Ghostable service. Normal Git synchronization still requires access to your remote, and provider deployments require their provider CLI and network.
Homebrew, npm, and release-archive installation or updating also require their distribution sources. Local protected access depends on the operating system's user-presence facility, not a Ghostable network call.
Recovery exercises
- Confirm the repository remote contains current
.ghostable/state. - Verify at least two owner devices can run
ghostable access status. - Test a read-only pull or process injection from a secondary device.
- Review how CI and deploy tokens would be revoked and replaced.
- Document the external systems that receive plaintext after decryption.
Plaintext cleanup
$ ghostable env clean --dry-run
$ ghostable env clean
Cleanup includes Ghostable-generated backup files in the project root. Preserve a backup outside the working tree only when policy requires it, and protect that plaintext copy independently from the encrypted repository.
