Download

One archive for the dashboard server. Agents for your other machines are installed from the dashboard.

Vaultwitness 167 — Linux x86-64

2026-10-21 · server + agent · what changed
sha256: 25701178a4367440ddc3fcaf9a87447e5f12dac3bf8018a83976414d61a85c56
By downloading you agree to the license terms. The software is provided as is and used at your own risk.
Download .tar.gz

What you need

  • Linux with systemd: Debian, Ubuntu, RHEL, Rocky Linux, AlmaLinux and other current distributions. The dashboard server needs x86-64. The machines you check can be x86-64 or ARM64 (Raspberry Pi, ARM servers and NAS boxes). Windows and macOS are not supported yet.
  • restic or Borg (1.2 or newer) already installed on the machines with backups — the agent uses them.
  • Root access to install.
  • The machines must be able to reach the dashboard server on port 47000. The agents only connect out; they never open a port.

Install

  1. Unpack the archive on the machine that will run the dashboard, and run the installer:
    $ tar xzf vaultwitness-167-linux-amd64.tar.gz
    $ cd vaultwitness-167-linux-amd64
    $ sudo sh install.sh
  2. It prints the dashboard address, the password and the certificate fingerprint. Open the address in a browser.
  3. Press + in the dashboard, enter a name, and paste the command it shows on the machine you want to check. Repeat for each machine.
  4. The agent finds the restic and Borg repositories by itself and the first check starts. Results show in minutes.

Upgrade and remove

  1. Upgrade: unpack the new archive and run sudo sh install.sh again. Settings, history and the certificate are kept. Agents update themselves from your server.
  2. Remove: sudo sh install.sh --uninstall removes the programs. Add --purge to also delete the settings, history and certificate.
  3. All options: sh install.sh --help.

Open-source agent

The agent runs as root on your servers and reads your backups, so you should be able to see exactly what it does. Its code is public under the Apache License 2.0. The dashboard server is a paid product.

Source code

Read it, audit it, build it yourself. The agent only collects facts and runs the checks the server asks for — it never opens a port and never sends your files anywhere.

Download the source (167)

Apache License 2.0 · © Vaultwitness authors

Build it yourself

  1. Install Go (any recent version — the build below fetches the exact one we use).
  2. Unpack the source of the version your server runs:
    $ tar xzf vaultwitness-agent-167-src.tar.gz
    $ cd vaultwitness-agent-167-src
  3. Build it exactly as we do:
    $ CGO_ENABLED=0 GOOS=linux GOARCH=amd64 GOTOOLCHAIN=go1.23.4 \
      go build -trimpath -buildvcs=false \
      -ldflags "-s -w -X github.com/insoftcompany/vaultwitness/internal/version.Version=167" \
      -o vaultwitness-agent ./cmd/agent
  4. Compare with ours: sha256sum vaultwitness-agent gives exactly the checksum of the release below.
  5. Using your own build? Turn off Update the agent automatically in that host's settings, or the server will replace it with its own copy.

Agent releases

VersionDateWhat changed
1672026-10-21Prometheus /metrics (with its own token) and /health for uptime monitors. A Feedback link in the dashboard. A forgotten dashboard password can be reset on the server with one command, shown on the sign-in page.linux-amd64 · sha256 · linux-arm64 · sha256 · source
1652026-10-20Proxmox Backup Server: machines backed up to PBS get a schedule and a no-new-backup alert of their own, and a machine with its own agent shows as one row. A verification report for auditors, sent by email or Telegram. The dashboard shows new results without a refresh. Clearer alerts: how long a host was silent, and turning an alert off no longer reads as fixed.linux-amd64 · sha256 · linux-arm64 · sha256 · source
1382026-10-15Borg Backup support. The agent finds Borg repositories by itself — in backup scripts and in borgmatic configurations — restore-tests the newest archive with borg extract, runs borg check and a full --verify-data re-read once every N deep checks, and explains Borg's job errors in plain words. Each repository now shows whether restic or Borg wrote it.linux-amd64 · sha256 · linux-arm64 · sha256 · source
1342026-10-14The agent now finds restic repositories set up with resticprofile or autorestic by itself, with their passwords, cloud credentials and backup jobs. Snapshot lists show each snapshot's status as a coloured stripe, and failed snapshots stand out.linux-amd64 · sha256 · linux-arm64 · sha256 · source
1332026-10-14The agent now also runs on ARM Linux (arm64): Raspberry Pi, ARM servers and ARM NAS boxes. "Add host" picks the right build by itself.linux-amd64 · sha256 · linux-arm64 · sha256 · source
1322026-10-13Clearer offline activation on the License page: the files go through the computer running your browser, and if the activation file ended up on the server you can paste its text instead.linux-amd64 · sha256 · source

Every release has its program, checksum and source side by side. The agent's checksum for 167 is 67c78a109e9ee5a51863974bb5e87b48c0cef33fbe56fe46843d3e871c413e1b.