Uninstall and re-enroll

Removing an endpoint has two parts: removing the agent on the machine, and revoking the endpoint in Restow. Backups that already exist stay in your storage target in both cases. Since 0.4.5 a third step is possible: removing the revoked machine from Restow, with its backups deleted at once or when they expire (below).

Remove the agent on the machine

sudo restow-agent uninstall

On a terminal, the command asks for confirmation first. --yes skips the question. If restow-agent is not found, use the full path: sudo /opt/restow-agent/bin/restow-agent uninstall on Linux, sudo '/Library/Application Support/Restow/bin/restow-agent' uninstall on macOS.

If the agent is broken or already gone, use the install script with --uninstall. The script also removes leftovers when the restow-agent binary is missing.

# Linux
curl -fsSL 'https://<your instance>/install/linux.sh' | sudo sh -s -- --uninstall
# macOS
curl -fsSL 'https://<your instance>/install/macos.sh' | sudo sh -s -- --uninstall

What is removed

• the service (the systemd unit or the LaunchDaemon),
• the folder /etc/restow-agent: the stored credentials and the hook policy (state.json) and the hook scripts in hooks.d,
• the working data (/var/lib/restow-agent: cache, temporary files, status, undelivered run reports),
• the binaries restow-agent, restow-agent.prev and restic in /opt/restow-agent/bin (macOS: /Library/Application Support/Restow/bin), the license notices THIRD_PARTY_NOTICES.txt next to that folder, the folders once they are empty, and the link /usr/local/bin/restow-agent,
• the log folder /var/log/restow-agent.

Keep a copy of your hook scripts elsewhere if you still need them.

Options

Option	Effect
--yes	Do not ask for confirmation.
--keep-logs	Keep the log folder.

What stays

The backups stay on the instance, in your storage target. The endpoint also stays in Restow until you revoke it, and until then the daily retention run keeps applying its rules to the backups. A server that has been removed but not revoked is reported as silent after 2 hours.

Revoking and uninstalling delete nothing. A revoked endpoint is no longer pruned, so its snapshots stay as they are, and you can still browse them and download files as a ZIP. Only Remove from Restow deletes the backups (since 0.4.5, see below); before 0.4.5 there was no way to delete a revoked machine together with its restore points. See Restore. Since 0.4.0 a revoked machine is hidden in the inventory until you choose Show revoked machines, and File restore lists it in its own group, Revoked machines. Revoking or uninstalling every machine is also the first step when you want to change the tenant’s primary storage target, which the server refuses while endpoints are active (see Overview).

Revoke or uninstall in Restow

Open the machine under Servers & clients → Inventory, the Settings tab, and the section Stop backing up this machine (called Remove this machine before 0.4.0). Neither action deletes the machine or its backups: the machine stays in the inventory as revoked, hidden until you show revoked machines, and the backups that exist stay restorable.

Action	What happens
Uninstall agent	Restow sends an uninstall task. The agent removes itself from the machine with its next contact, and the endpoint is revoked when it does. If the machine is off or offline, this waits until it reports back; since 0.4.5 the page then offers Revoke now.
Revoke machine	The machine is refused at once: no more backups and no more tasks. The agent stays installed and keeps trying until you uninstall it on the machine. Revoking cannot be undone. To back the machine up again, enroll it anew.

Use Uninstall agent when the machine is reachable. Use Revoke machine when it is lost, stolen or cannot be reached, or when you want to cut it off right now. Both are recorded in the audit log (endpoint.uninstall.requested, endpoint.revoked).

Remove a machine from Restow (since 0.4.5)

A revoked machine can be removed from Restow, with or without its backups. A machine that is not revoked cannot be removed (“Revoke the machine first”). Open the revoked machine (choose Show revoked machines first), its Settings tab and the section Stop backing up this machine, and choose Remove from Restow. The machine’s detail panel on Inventory offers Remove from Restow as well once the machine is revoked. You choose between two ways:

Choice	What happens
Remove from the list, keep the backups until they expire	The backups stay stored until the machine’s retention would have let the newest of them go, then they are deleted. That date is the newest backup plus the longest rule of the machine’s retention, read as time (N days, N weeks, N calendar months; twelve months with the default). restic’s rules count snapshots, not time, and would keep the last ones forever on a machine that no longer backs up. A retention without a rule keeps everything, and this choice is refused for it.
Delete the machine and its backups	Every backup of the machine is deleted now. This is refused while a legal hold over the whole tenant or an unresolved suspicious restore point of the machine holds them.

Removing needs a tenant administrator, the hostname typed to confirm and a sign-in from the last 10 minutes. It cannot be undone: deleted backups cannot be restored. Afterwards:

• The machine leaves every list, picker, dashboard and count, and its backup job. Its runs, reports and audit entries stay, so History and the audit log still name it.
• The worker deletes the machine’s repository (endpoints/<endpoint id>/) on every storage target that holds files of it: the primary, its copies and the retired primaries of a change of the primary repository. It does so at once for Delete, and when the backups expire for keep.
• Holds are respected. If a legal hold over the tenant or an unresolved suspicious restore point holds the backups, nothing is deleted and the worker checks again after a day, also when the backups expire. Objects that the storage still locks (S3 Object Lock, a directory’s deletion delay) are deferred until their lock runs out, recorded like a refused prune and left out of the lock renewal.
• Inventory lists the removals that are still pending, below the machines, as Backups of N removed machines, each with Deleted on a date, Being deleted, the lock (Partly locked by the storage until a date) or the hold (Held by a legal hold over the whole tenant, Held by an unresolved suspicious restore point).
• Every step is audited: endpoint.removed, endpoint.removal.held, endpoint.removal.deferred, endpoint.removal.completed and endpoint.removal.failed.

A request that cannot be carried out answers with a stable code: 409 endpoint-not-revoked, endpoint-removal-legal-hold, endpoint-removal-suspicion-hold or endpoint-removal-never-expires, and 422 endpoint-confirm-hostname (the hostname does not match).

Removed machines keep their backups browsable (since 0.4.6). Until the backups are deleted, the page of a removed machine offers their restore and nothing else: the restore points, browsing, the ZIP download and the repository password keep working for them, audited as for a revoked machine, and Restore files in the list of removals opens File restore for that machine. Restoring onto the machine and every other action stay refused (404). Once the backups are deleted, the machine is gone for every reader. In 0.4.5 this was a known issue: removed machines could not be restored from in the interface. The dialog Remove from Restow says so since 0.4.7: before, it still said that file restore no longer offers the backups of a removed machine.

Revoke suggested, and Revoke now. A machine that has not been in contact for longer than a number of days suggests revoking it: the badge Revoke suggested and the note “Revoke?” on its page and among what needs attention, and in its detail panel Revoke now. The number of days is set per machine under Alerts of the machine (Days without contact before suggesting to revoke, 30 by default). An uninstall that waits for a machine that is off now offers Revoke now as well, for a machine that is gone: revoke it, then remove it.

Enroll again

To connect a machine again, for example after it was revoked or its credentials were lost:

1. In Restow, open Servers & clients → Inventory and choose New server or New client. The window shows a new install command and a new one-time token.
2. On the machine, uninstall the agent (see above) and run the new install command as usual. The script asks for the token with hidden input.

To keep the installed agent instead, enroll it again with enroll --force. The command reads the token from the environment only, so set it in a root shell without putting it on a command line:

sudo -s
stty -echo; printf 'Token: '; read RESTOW_TOKEN; stty echo; echo
export RESTOW_TOKEN RESTOW_URL='https://<your instance>'
/opt/restow-agent/bin/restow-agent enroll --force
/opt/restow-agent/bin/restow-agent service restart
exit

On macOS, use '/Library/Application Support/Restow/bin/restow-agent' instead of /opt/restow-agent/bin/restow-agent. Avoid sudo RESTOW_TOKEN=... restow-agent enroll: that form puts the token in the process list of the machine. A new enrollment keeps the machine’s hook policy.

Running the install command on a machine that is already enrolled does not enroll it again. The script keeps the existing enrollment.

A new enrollment creates a new endpoint with its own repository. The old endpoint and its backups stay in Restow until you revoke the old endpoint, and they stay stored until you also remove it from Restow and delete them (since 0.4.5). Its backups do not merge into the new one.

macOS: clean up Full Disk Access

The uninstall removes the agent, but it does not change the privacy settings. Remove the entry yourself:

1. Open System Settings > Privacy & Security > Full Disk Access.
2. Select restow-agent and restic (from /Library/Application Support/Restow/bin) if they are still listed and remove them.

On a Mac that is managed through MDM, remove the Privacy Preferences Policy Control profile for the agent in your MDM.