README

T3Vault

Encrypted backups and disaster recovery for TYPO3 — including a standalone app

that still works when TYPO3 itself is down.
Blockchain-verified backup integrity (OpenTimestamps / Bitcoin).

Why · Screenshots · Features · Installation · Quick start · Documentation

Extension key: t3vault
Composer package: codemacher/t3vault
Version: `0.1.18`

Beta notice: This is the first public release line. Treat it as production-curious, not production-proven. Please test restore drills on a staging host before relying on it for live sites.

T3Vault dashboard with backup stats and recent jobs

Why T3Vault?

Most TYPO3 backup tools assume the CMS is still healthy. T3Vault ships a standalone recovery UI under <web-dir>/t3vault that can create, download and restore backups without a working TYPO3 instance — useful after a broken deploy, lost database, or failed upgrade.

Two capabilities that set it apart:

OpenTimestamps integrity — every completed backup is sealed (integrity.json + OpenTimestamps). The digest is submitted to public calendars and time-stamped on the Bitcoin blockchain (a public ledger — not a payment or currency transfer). Later you can prove whether an archive was altered after sealing — independently of TYPO3, the hoster, or whoever stored the file.
Layout conversion on restore — restore a Composer site as classic/legacy (document-root layout), or the other way around. Useful when the target host has no Composer workflow, or when you want a Composer project from a classic backup (including DDEV).

Screenshots

Dashboard	New backup

Standalone login	Settings

Features

OpenTimestamps seals — SHA-256 hashes, optional HMAC, OpenTimestamps receipt (integrity.json.ots) time-stamped on the Bitcoin blockchain; detect silent changes to stored backups
Composer ↔ classic restore — convert layout during restore (Composer → legacy/classic document root, or classic → Composer)
Full & partial backups — database, config/, local packages, Composer files, fileadmin / FAL (both TYPO3 layouts)
AES-256 encrypted ZIP parts — shared backup password; large sites split into multiple parts
Downloadable .t3vault.tar — archive plus restore installer / DDEV setup helper
Standalone login — password gate + ENABLE marker (same idea as the TYPO3 install tool marker)
TYPO3 backend module — admin-only embed of the UI + password management
Scheduled tasks — integrate with the TYPO3 Scheduler (t3vault:run)
Verify CLI / PHAR — check archives and OTS proofs without the web UI

Requirements

TYPO3 13.4 LTS or 14.x
PHP 8.2 – 8.5
Composer-based installation recommended
Optional: typo3/cms-scheduler for timed backups
Optional: outbound HTTPS for OpenTimestamps calendars (HTTP proxy supported)

Installation

Composer (Packagist)

composer require codemacher/t3vault

Package: packagist.org/packages/codemacher/t3vault
Source: git.codemacher.de/codemacher/t3vault

For a specific beta tag:

composer require codemacher/t3vault:0.1.18

Dependency codemacher/elephstamp (OpenTimestamps) is also on Packagist.

After install

Composer provisions the standalone app into <web-dir>/t3vault via installer scripts. Configuration and secrets live outside the web root:

var/t3vault/
  config.local.php       # standalone password hash, signing secret, settings
  backup.password.php    # archive encryption password
  backups/               # backup jobs & artefacts
  ENABLE_T3VAULT         # temporary unlock marker (like ENABLE_INSTALL_TOOL)

Open the T3Vault backend module (admins only) to set the standalone password, or create the enable marker and use the standalone login.

After composer remove codemacher/t3vault, delete the leftover web copy if present:

rm -rf public/t3vault

Quick start

Install the extension and clear caches.
As a TYPO3 admin, open Admin Tools → T3Vault (or your configured module path).
Set the standalone password and the backup (AES) password in Settings.
Run a first Database or Full site backup (integrity sealing + OpenTimestamps runs automatically when finished).
Download a .t3vault.tar and practice a restore on a throwaway host / DDEV project — pick classic target layout if you want a Composer backup unpacked as legacy TYPO3.

Prove a backup was not changed

php t3vault-verify.phar /path/to/backup_dir
# optional: official ots client — see Documentation/Integrity/

A matching OpenTimestamps proof means the seal existed at that Bitcoin-blockchain time; a mismatch means the artefacts were altered after sealing.

Security notes

The standalone app is publicly reachable under /t3vault — treat it like the install tool: strong password, short-lived ENABLE_T3VAULT marker, keep var/t3vault/ out of the web root.
Backup archives are encrypted, but the download/restore path is powerful; restrict who can unlock the UI.
Prefer HTTPS in production; harden web-server rules for *.tpl, logs and the API as described in Installation.
See the project security audit history in the development repository before promoting beyond beta.

Documentation

Full manual (Markdown) in this repository under Documentation/:

Links


Public package repo	https://git.codemacher.de/codemacher/t3vault
Development	https://git.codemacher.de/codemacher/t3vault-development
Composer package	`codemacher/t3vault`
OpenTimestamps helper	https://github.com/codemacherUG/Elephstamp

Development

Sources and the webpack build live in the development monorepo t3vault-development. This repository only contains the built, installable extension package (including Resources/Private/StandaloneApp).

Support

Prefer issues in the development tracker.
Contact: mail@codemacher.de

License

GPL-2.0-or-later — see LICENSE.

codemacher / t3vault

Maintainers

Package info

Statistics

Security