Frequently asked questions

Common questions about setup, backups, restore, and notifications. See the full documentation for details.

What Cloudflare API token permissions do I need?

Account: Cloudflare Tunnel -> Edit and Zone: DNS -> Edit. If you only plan to take backups and never restore, you can reduce the token to read-only permissions afterwards.

What happens if I don't set TOKEN_ENCRYPTION_KEY?

The API token is not written to SQLite at all. It's still usable via the browser cookie or environment prefill during your session, but it won't be saved server-side; scheduled automatic backups won't have server-side credentials unless CLOUDFLARE_API_TOKEN is set in the environment.

Can I restore a backup to a different tunnel or account?

Yes. Restoring replaces the current remote configuration of the selected tunnel with the snapshot's configuration: you choose the target tunnel at restore time, which can be the original one or a different one. The restore history on the backup detail page records whether the target matched the original tunnel and account.

Why does a restored route return 502 even though the backup worked fine?

Check whether that ingress rule's origin is localhost or a loopback address (127.0.0.1, ::1) — the backup detail page flags these as host-local. That address is resolved relative to wherever cloudflared runs, and when it runs in a container, localhost means the container, not the Docker host. Point the rule at host.docker.internal, the bridge gateway IP, or a service/container name instead. Use Preview changes on the restore form to see the full ingress diff, including host-local origins, before you apply.

Can I see what a restore will change before applying it?

Yes. Press Preview changes on the restore form instead of Restore backup. Tikka Masala fetches the target tunnel's live configuration, diffs it against the snapshot, and shows every ingress rule in order (added, changed, or unchanged, with an inserted rule's position visible so you can spot one that would shadow an existing rule), removed rules, a note if only the rule order differs, and any change to non-ingress settings such as warp-routing. Nothing is applied and no restore history is recorded until you press Restore backup.

What's the difference between demo mode and normal mode?

In demo mode (DEMO=true), nothing is persisted: no auth data in SQLite or cookies, no automatic backups, no notifications, and the backup archive is disabled. Manual tunnel listing and manual backup downloads still work; it's meant for trying the UI, not for real use.

How does automatic backup timezone work?

By default, the schedule uses the timezone detected from the browser when you save it. If you want every user and the scheduler itself to agree on a single fixed timezone, set AUTO_BACKUP_TIMEZONE (e.g. Europe/Rome).

Can I back up only some tunnels, or less frequently for some?

Yes, on the Advanced schedule page. Choose between backing up all tunnels or a selected subset, and set a per-tunnel frequency override: every run, once per week, or once per month.

How does backup retention work?

Set BACKUP_RETENTION_DAYS and Tikka Masala automatically deletes backup files and their database records (including restore history) once they're older than that many days, right after new backups are created.

Do I need Docker?

No, but it's the easiest path. Tikka Masala also runs directly with Python 3.12 and uvicorn if you prefer a bare install: see Running the app.

Where is everything stored?

Under DATA_DIR (default /data, typically mounted from ./data): app.db for metadata, history, and saved auth, and backups/*.json for the snapshots themselves.

Can I use both webhook and Telegram notifications together?

Yes, they're independent channels: enable either one on its own or both at the same time, each with its own event list.

Why don't my Telegram notifications show the details block anymore?

As of 1.3.5, Telegram messages are compact by default: only the title and message, no key: value details block. Uncheck Compact Telegram notifications on the notification customization page to bring it back. The webhook channel always receives the full payload regardless of this setting.

Does Tikka Masala back up my whole Cloudflare account?

No. It only backs up the tunnel configuration returned by the Cloudflare Tunnel configuration endpoints for the tunnels you back up, plus metadata like timestamp and tunnel name, not arbitrary account-wide settings.