Frequently asked questions

Common questions about setup, backups, restore, and notifications. See the full documentation for details.

What Cloudflare API token permissions do I need?

Account: Cloudflare Tunnel -> Edit and Zone: DNS -> Edit. If you only plan to take backups and never restore, you can reduce the token to read-only permissions afterwards.

What happens if I don't set TOKEN_ENCRYPTION_KEY?

The API token is not written to SQLite at all. It's still usable via the browser cookie or environment prefill during your session, but it won't be saved server-side; scheduled automatic backups won't have server-side credentials unless CLOUDFLARE_API_TOKEN is set in the environment.

Can I restore a backup to a different tunnel or account?

Yes. Restoring replaces the current remote configuration of the selected tunnel with the snapshot's configuration: you choose the target tunnel at restore time, which can be the original one or a different one. The restore history on the backup detail page records whether the target matched the original tunnel and account.

What's the difference between demo mode and normal mode?

In demo mode (DEMO=true), nothing is persisted: no auth data in SQLite or cookies, no automatic backups, no notifications, and the backup archive is disabled. Manual tunnel listing and manual backup downloads still work; it's meant for trying the UI, not for real use.

How does automatic backup timezone work?

By default, the schedule uses the timezone detected from the browser when you save it. If you want every user and the scheduler itself to agree on a single fixed timezone, set AUTO_BACKUP_TIMEZONE (e.g. Europe/Rome).

Can I back up only some tunnels, or less frequently for some?

Yes, on the Advanced schedule page. Choose between backing up all tunnels or a selected subset, and set a per-tunnel frequency override: every run, once per week, or once per month.

How does backup retention work?

Set BACKUP_RETENTION_DAYS and Tikka Masala automatically deletes backup files and their database records (including restore history) once they're older than that many days, right after new backups are created.

Do I need Docker?

No, but it's the easiest path. Tikka Masala also runs directly with Python 3.12 and uvicorn if you prefer a bare install: see Running the app.

Where is everything stored?

Under DATA_DIR (default /data, typically mounted from ./data): app.db for metadata, history, and saved auth, and backups/*.json for the snapshots themselves.

Can I use both webhook and Telegram notifications together?

Yes, they're independent channels: enable either one on its own or both at the same time, each with its own event list.

Does Tikka Masala back up my whole Cloudflare account?

No. It only backs up the tunnel configuration returned by the Cloudflare Tunnel configuration endpoints for the tunnels you back up, plus metadata like timestamp and tunnel name, not arbitrary account-wide settings.