T3Vault

Encrypted backups and disaster recovery for TYPO3 — including a standalone app
that still works when TYPO3 itself is down.
Blockchain-verified backup integrity (OpenTimestamps / Bitcoin).

Why · Screenshots · Features · Installation · Quick start · Documentation

---

• Extension key: t3vault
• Composer package: codemacher/t3vault
• Version: `0.1.18`

Beta notice: This is the first public release line. Treat it as production-curious, not production-proven. Please test restore drills on a staging host before relying on it for live sites.

Why T3Vault?

Most TYPO3 backup tools assume the CMS is still healthy. T3Vault ships a standalone recovery UI under <web-dir>/t3vault that can create, download and restore backups without a working TYPO3 instance — useful after a broken deploy, lost database, or failed upgrade.

Two capabilities that set it apart:

1. OpenTimestamps integrity — every completed backup is sealed (integrity.json + OpenTimestamps). The digest is submitted to public calendars and time-stamped on the Bitcoin blockchain (a public ledger — not a payment or currency transfer). Later you can prove whether an archive was altered after sealing — independently of TYPO3, the hoster, or whoever stored the file.
2. Layout conversion on restore — restore a Composer site as classic/legacy (document-root layout), or the other way around. Useful when the target host has no Composer workflow, or when you want a Composer project from a classic backup (including DDEV).

Screenshots

Dashboard	New backup

Standalone login	Settings

Features

• OpenTimestamps seals — SHA-256 hashes, optional HMAC, OpenTimestamps receipt (integrity.json.ots) time-stamped on the Bitcoin blockchain; detect silent changes to stored backups
• Composer ↔ classic restore — convert layout during restore (Composer → legacy/classic document root, or classic → Composer)
• Full & partial backups — database, config/, local packages, Composer files, fileadmin / FAL (both TYPO3 layouts)
• AES-256 encrypted ZIP parts — shared backup password; large sites split into multiple parts
• Downloadable .t3vault.tar — archive plus restore installer / DDEV setup helper
• Standalone login — password gate + ENABLE marker (same idea as the TYPO3 install tool marker)
• TYPO3 backend module — admin-only embed of the UI + password management
• Scheduled tasks — integrate with the TYPO3 Scheduler (t3vault:run)
• Verify CLI / PHAR — check archives and OTS proofs without the web UI

Requirements

• TYPO3 13.4 LTS or 14.x
• PHP 8.2 – 8.5
• Composer-based installation recommended
• Optional: typo3/cms-scheduler for timed backups
• Optional: outbound HTTPS for OpenTimestamps calendars (HTTP proxy supported)

Installation

Composer (Packagist)

composer require codemacher/t3vault

Package: packagist.org/packages/codemacher/t3vault
Source: git.codemacher.de/codemacher/t3vault

For a specific beta tag:

composer require codemacher/t3vault:0.1.18

Dependency codemacher/elephstamp (OpenTimestamps) is also on Packagist.

After install

Composer provisions the standalone app into <web-dir>/t3vault via installer scripts. Configuration and secrets live outside the web root:

var/t3vault/
  config.local.php       # standalone password hash, signing secret, settings
  backup.password.php    # archive encryption password
  backups/               # backup jobs & artefacts
  ENABLE_T3VAULT         # temporary unlock marker (like ENABLE_INSTALL_TOOL)

Open the T3Vault backend module (admins only) to set the standalone password, or create the enable marker and use the standalone login.

After composer remove codemacher/t3vault, delete the leftover web copy if present:

rm -rf public/t3vault

Quick start

1. Install the extension and clear caches.
2. As a TYPO3 admin, open Admin Tools → T3Vault (or your configured module path).
3. Set the standalone password and the backup (AES) password in Settings.
4. Run a first Database or Full site backup (integrity sealing + OpenTimestamps runs automatically when finished).
5. Download a .t3vault.tar and practice a restore on a throwaway host / DDEV project — pick classic target layout if you want a Composer backup unpacked as legacy TYPO3.

Prove a backup was not changed

php t3vault-verify.phar /path/to/backup_dir
# optional: official ots client — see Documentation/Integrity/

A matching OpenTimestamps proof means the seal existed at that Bitcoin-blockchain time; a mismatch means the artefacts were altered after sealing.

Security notes

• The standalone app is publicly reachable under /t3vault — treat it like the install tool: strong password, short-lived ENABLE_T3VAULT marker, keep var/t3vault/ out of the web root.
• Backup archives are encrypted, but the download/restore path is powerful; restrict who can unlock the UI.
• Prefer HTTPS in production; harden web-server rules for *.tpl, logs and the API as described in Installation.
• See the project security audit history in the development repository before promoting beyond beta.

Documentation

Full manual (Markdown) in this repository under Documentation/:

• Introduction
• Installation
• Configuration
• Usage
• Integrity & OpenTimestamps

Links

Public package repo	https://git.codemacher.de/codemacher/t3vault
Development	https://git.codemacher.de/codemacher/t3vault-development
Composer package	codemacher/t3vault
OpenTimestamps helper	https://github.com/codemacherUG/Elephstamp

Development

Sources and the webpack build live in the development monorepo t3vault-development. This repository only contains the built, installable extension package (including Resources/Private/StandaloneApp).

Support

• Prefer issues in the development tracker.
• Contact: mail@codemacher.de

License

GPL-2.0-or-later — see LICENSE.