qKVMDocs
All pages

Export and import

Settings > Export and import writes the wall to a file, and takes a file in: to keep what was set up, to fill a second qKVM without typing every device again, or to move to another computer.

Export asks for your password again, and for what the file is to hold: the KVMs and servers, the saved actions, the alert settings, the wall's settings.

  • With a passphrase it is an encrypted file (qkvm-<date>.qkvm). It holds everything, the passwords of the devices, the texts of saved actions and the address alerts go to included, and opens with that passphrase only (scrypt and AES-256-GCM, as the saved passwords themselves are kept). The passphrase needs ten characters or more; keep it somewhere else than the file. Nothing of the wall can be read off the file without it, not a name and not an address either (its size says roughly how much is in it).
  • Without one it is a plain file (qkvm-<date>.json): the same, with every password and the alert address left out, and the saved actions that type a text left out with their text. It can be read, compared and kept anywhere.

Import reads either kind and says what is in it before anything is taken: every device with its address, how its certificate is checked where that is not the usual way, and where its console link leads; every saved action with what it does, and for one that types a text, the text (which the wall shows nowhere once it is saved). A file may come from somebody else: read that list. Then it takes in what you tick.

  • KVMs and servers are added where the wall has none at that address, and none that is the same device under another address (known by what it says it is, or by its certificate). The page asks "keep both?" about such a one; a file cannot be asked, so it is left out and said, unless the wall it comes from was told "keep both" for that very tile.
  • A saved action is added where the wall has none of that name, whatever it does.
  • Nothing that is on the wall is changed or removed by a file, and taking the same file in twice adds nothing twice.
  • A device from an encrypted file works at once, with the password and the remembered certificate it came with. One from a plain file says "Login failed" on its tile, with Update login beside it, until its password is typed.
  • The alert settings and the wall's settings, of which there is one set, are replaced, and only where you tick them. A file without an alert address leaves the address the wall has. The link an alert carries back to the wall, and a pause, are the wall's own and are in no file.
  • No device is talked to while a file is read. What does not pass (an address that is none, a kind of device this version does not know) is left out, and said.

A file written by hand in the same form is taken in as well: a list of devices as {"format": "qkvm-export", "version": 1, "devices": [{"url": "https://192.168.1.20", "kind": "kvmd", "username": "admin", "password": "..."}]} fills a new wall in one go. A plain file with passwords in it is whoever wrote it's own to look after; the page says so when it reads one.

Not in any such file: accounts, tokens and display links, two-factor keys and the recovery key. Each is locked to the key of the qKVM it was made on, and could be carried over only by carrying that key. Nor the history of what the wall saw: that is what happened here, not a setting, and an import leaves the one that is here as it is. To keep a whole qKVM, accounts and all, keep a copy of its data folder with qKVM stopped, plus a separately protected backup of its server storage key. Keep a record that pairs those backups; an account password or recovery code cannot replace that key. See How it is protected.

An export is written to the activity log, with who made it and whether it was encrypted (a wrong password at it as well), and every device a file adds is written there by name and address, as one that is typed in is. A token cannot ask for one, and neither can an account that only your identity provider signs in: it has no password here to be asked for. Export as an admin that has one.