Panel storage, backup, updates and installed recovery

This guide covers storage locations, disk previews, appliance configuration backups, signed updates, recovery, boot attestation and internal-disk installation. Open the native Appliance operations page at /rust/appliance/operations, or use the individual pages listed below. Only signed-in administrators see privileged controls; final disk, installer and boot commits may also require the root account.

Navigate and review status

1. Open /rust/appliance/operations to reach Storage, Backup & Restore, System updates, Appliance firewall, Boot attestation, Unified setup and Appliance guided tasks. Do not treat a status summary or preview as proof that a privileged change succeeded.
2. Open Storage (/rust/storage) to review location roles, model filesystem free/used capacity and disk protection before choosing an action. The capacity meter is read-only and reports the same live filesystem data as the former storage tab. Local, NFS and SMB changes use a separate Test proposed location control and a confirmed Apply proposed location control. A queued job is not a completed mount or migration: its receipt shows a live owner-observed status when scripting is available, and retains an independent status link when scripting is disabled. Request cancellation uses a separate, confirmed form; a cancellation request does not prove that a job stopped. Credential fields are redacted in receipts and live status.
3. In Disks and partitions, choose an eligible, unprotected disk, preview a partition plan and explicitly confirm the exact device before committing. Create GPT partition / add partition adds a new partition to suitable free GPT space. The current route set does not offer an in-place data-partition resize operation; do not interpret adding a partition as growing an existing filesystem. Back up data and use a separately validated migration procedure when existing volumes need expansion.
4. The installer card is shown only where the installed appliance owner offers internal installation. It is not a generic Linux disk operation.

Back up configuration and move it to another stick

1. On the source stick, open Backup & Restore at /rust/backup. Select Create backup, enter a safe label and choose Create verified backup, or explicitly confirm Create compatible backup to use the original archive-writing route. Inspect the verified backup inventory and its SHA-256 checksums. The archive download links appear only for safe filenames returned by the verified local catalogue, or after a successful owner creation receipt. An archive download is not a portable configuration export. Full archives include panel state but not copied model files or engine binaries. Full archives are sealed to their original appliance; do not try to move one to another stick.
2. Under Move configuration between sticks, select Export portable configuration (JSON). Securely copy the downloaded file to the destination. This portable format is separate from the machine-sealed full backup and filters protected secrets and machine-specific identities.
3. On the destination stick, paste the exact portable JSON into Preview portable configuration on this stick and select Preview portable restore. Inspect affected configuration and the returned plan_sha256. The preview writes no settings.
4. Paste the same JSON into Restore reviewed portable configuration, enter the Exact preview plan SHA-256, check the explicit restore confirmation, then select Restore reviewed configuration. The owner validates the archive SHA-256, destination plan and current files; if changed, preview again. Inspect the result, including the list of restored files and the pre-restore backup.
5. For a restore on the same original appliance, Preview changes and Restore verified archive use a sealed full backup and its exact preview plan. The new Preview and restore a sealed full backup guide at /rust/appliance/guides/appliance.restore-full walks through verified inventory, owner preview, manual review, plan-bound restore and recovery-status verification. Copy the exact SHA-256 returned by the preview; if the files change, preview again. The owner creates a pre-restore archive and checks the live state before applying. Recover only an interrupted restore requires the exact incident ID and the typed word RECOVER; do not attempt an ordinary second restore while a recovery journal is active.

Signed-in viewers may read the Storage and maintenance inventory, but cannot see privileged mutation forms. Backup, update and guided restore controls require an administrator; individual disk, installer and signed boot commits may impose stricter root or owner checks. All native forms use the existing authenticated owner routes, not a second storage or backup implementation.

The guided sequence Back up and move Panel configuration at /rust/appliance/guides/appliance.transfer-config performs inventory, source backup, destination preview and reviewed portable restore through authenticated routes. Export and copying between sticks are explicit operator steps. A guided step is not an approval for a later step.

Update safely and recover

1. Open System updates (/rust/settings/update). Inspect installed version, owner admission state, signed source and rollback floor. Use Check for updates to validate the configured signed release source before selecting a candidate.
2. Review Approve system update separately. Approval does not apply an update. Only a current, verified candidate is eligible. Inspect build provenance and deployment authority when shown.
3. On an installed LexiOS system, inspect LexiOS system slots (A/B update), including active, known-good and next-boot slots. Choose Preview update, check the exact inactive target and release, and require root confirmation for Commit update. The signed owner controls staging and boot; the UI cannot bypass its release checks. Reboot when instructed; examine observed slot health after boot.
4. If recovery is necessary, open Backup & Restore and use Verify the known-good slot, Preview rollback to the known-good slot or Preview reconstruction before Commit recovery. A rollback may be refused when there is no verified known-good target. Do not assume a preview has changed the boot slot.
5. Repository operations Inspect protected repository plan, Request authenticated source build, Request verified installer/live-image build, Request signed fleet rollout, and Change protected UTC update schedule appear only when the current owner advertises the corresponding pinned-source policy. Their API owner validates source pin, signed tree, installed generation and relevant policy. Requests and accepted receipts are not proof that an image or rollout has finished.

The guided sequence Check, verify and safely update A/B slots at /rust/appliance/guides/appliance.update-safely checks status, links to signed release verification, runs the owner preview and root-owned commit, and directs the operator to post-boot verification and recovery.

Firewall, attestation, installation and windows

Appliance firewall at /rust/system/firewall reports policy and any connection-loss warning. Always preview, apply, then confirm that network access survived; pending changes can be reverted. The appliance-only controls appear only on LexiOS; a plain Linux host uses its own firewall owner. Never treat a blank status on an unbound owner as a permissive firewall.

Boot attestation at /rust/system/attestation verifies the signed report for the current boot. Use Export the signed report (JSON) for independent review. A missing or non-verifying report is not success; the exported report does not itself change boot state.

Install LexiOS on an internal disk at /rust/appliance/guides/appliance.install-internal walks through Installer disk inventory, Preview installation, a typed hardware serial, and Install LexiOS (erases the disk) on /rust/storage. Review refusal reasons and the planned partition layout. Root-only commits are destructive. Keep the live stick inserted while the installer reports running progress, and do not treat an accepted or pending job as a completed installation.

Maintenance windows at /rust/maintenance can schedule approved backup jobs and other operations. The reversible guide Create and undo a disabled maintenance window at /rust/appliance/guides/appliance.reversible-window creates only a disabled window with a new unique ID, then offers Run undo to delete it. It refuses collisions and does not turn on any scheduled job.

For setup and access changes, open /rust/appliance/setup and use the owner-controlled enrollment, network preview/confirm/revert, access-policy validation and reviewed setup apply. Hardware- or root-specific actions are never simulated by the browser.

Complete control reference

Each native control has a ? help marker describing its effect; the following labels are also the feature names used by the help registry. The page path is where the control appears (some are hidden when the required appliance capability is absent).

Related pages

See Install From USB, Panel LexiOS and Secure Boot, Panel Network and Access, Reference Guided Tasks, and Troubleshooting.