Your backups are encrypted on your device, split with erasure coding and placed on other members' disks. A weekly restore test proves they come back. Repair runs without you.
Backup run by the people who use it, with the guarantees spelled out
Every object is encrypted with a key derived from your member secret and the content. Nobody else can read it, not the hub, not other members.
Each object is split k-of-n, today 2-of-3 on the live network, and the shares go to other members' storage servers. The split is set by the signed manifest and can change through a declared transition.
A backup set is one or more folders. The agent scans them daily. Every week a restore test reads a sample back and compares it to the source.
Storage servers scrub their shares monthly. The hub schedules repair of under-placed objects without involving the owner, and the status page shows it.
Snapshots are kept by a retention policy. Deleted data stays recoverable for 30 days.
One program named redundanet, written in Go. No containers, no Python, no Docker. It updates itself from a signed release index.
Identity from a phrase, membership in a signed file, data on your peers' disks
Scanned daily
On your device
Erasure coding, 2-of-3
Any 2 of the 3 shares rebuild the object. Storage servers hold ciphertext only; file names and folder structure are inside encrypted objects too.
redundanet identity init shows a twelve-word phrase once. Your member key (Ed25519) comes from it. Every device gets a certificate signed by the member key.
Member and storage lists live in a manifest in the GitHub repository, signed offline by the maintainer's operator key. Agents fetch it every five minutes and apply a newer signed revision at once.
The agent reaches the hub outbound. Devices connect to each other directly through hole punching when they can, otherwise through the hub's relay. No inbound firewall rule needed.
Devices authenticate each other over QUIC with TLS 1.3, by their device keys. A storage node may forward a UDP port to be reached directly more often.
The agent checks the signed index hourly, downloads, verifies the hash, runs the new version in probation for up to two minutes, keeps the old binary as redundanet.old, and rolls back by itself if the new one does not reconnect.
Linux, macOS and Windows, one static binary each
The limits of 3.0.0, stated plainly
You need a GitHub account. Contributing disk is welcome, not required.
Install the agent on your laptop. The phrase is shown once; write it down. Then join the network with the public descriptor from the install page.
redundanet identity init --network redundanet
redundanet network join <descriptor>A Linux machine with at least 10 GiB free. Three commands, one of them on your laptop, give you the node's device key for the form.
Storage node setup →The form opens a GitHub issue. A workflow validates it and opens a pull request; the maintainer signs the manifest offline and merges. Every agent applies it within five minutes, and your devices are in.
Join form →Where to look while the network runs
Members, devices, grid health, repair, and per member the day of the last backup and the restore-test streak. No IP addresses.
Open the status page →The project collects nothing: no accounts, no analytics, no telemetry. This site stores only your language choice in your browser. The policy lists exactly what the software sends, and to whom.
Read the privacy policy →Windows signing through SignPath and macOS notarization are set up in the release workflow but not yet active (accounts pending); until then every binary is unsigned and the signed release index is the way to verify a download on every platform. Linux binaries are never code-signed; the index covers them.
The code signing policyThe previous grid (Python CLI, Docker Compose, tinc VPN, Tahoe-LAFS) stays live until a stop date the maintainer announces, because its Tahoe shares still hold members' data. Existing members move at their own pace.
Migration guide →Install, join, backups, configuration, operators, security, architecture, every command and the FAQ, as Markdown in the repository.
Docs index →GPL-3.0, on GitHub. The agent is a Go module under agent/. Releases are built only from tags on main, and the maintainer reviews every change.