Skip to content

Move The Server To Another PC

GuardianNode does not yet ship an automated dashboard migration tool. The planned migration flow will eventually cover pairing codes, encrypted transfer, device token rotation, and rollback. For the alpha, treat server migration as a manual administrator task.

Manual Alpha Path

Use this only if you are comfortable backing up and restoring local application data.

  1. Stop GuardianNode on the old server or all-in-one PC.
  2. Create a portable master-key backup from the backend environment. From a source checkout, run this in the backend/ directory: 
    python -m app.services.encryption export-key-backup ./guardiannode-master-key-backup.json
    Use a strong passphrase and store it separately.
  3. Back up the full backend data directory, including:
  4. guardiannode.db
  5. the encrypted evidence/blob directory
  6. keys/master.key or keys/master.key.dpapi
  7. configuration files you changed
  8. Install GuardianNode on the new server using the normal server install guide.
  9. Stop GuardianNode on the new server before first use.
  10. Restore the old backend data directory onto the new server, preserving file ownership and permissions.
  11. Restore the portable key backup if the restored key is machine-bound or missing: 
    python -m app.services.encryption import-key-backup ./guardiannode-master-key-backup.json
  12. Start GuardianNode on the new server.
  13. Open the dashboard and confirm historical alerts, devices, and settings are present.
  14. Re-pair each child device with a fresh code and .gnpair bundle from the new server. This installs the new family CA pin and rotates its credential.
  15. Test that a synthetic event arrives from every device.

Do not delete the old server data until you have verified the new server is working and you have a separate backup.

Important Notes

  • The recovery code resets dashboard access only. It does not reconstruct the evidence master key.
  • If the evidence master key and portable backup are lost, encrypted evidence may not be recoverable.
  • Separated mode uses server-authenticated HTTPS with a local family CA. A VPN is still recommended for network isolation; never expose the backend directly to the public internet.
  • Device trust is deliberately re-enrolled after a server move rather than silently copying a stale server identity.

Planned Automated Migration

Future versions may add a dashboard-assisted migration workflow. Until that exists in the product, docs should not assume a Settings -> Migration page or migration pairing code.