Database backups and restore

System → Diagnostics → Database backups. The “Make a backup” button puts a file next to the site (in storage/backups, outside the public folder), and you can download it. A backup is a snapshot of the whole database: posts, products, users, settings. Site files (uploads, code) are not included.

Scheduled backups. Settings → General: “Database backup every N days” (zero means off) and “How many backups to keep”; old ones are removed automatically. A backup is also made automatically before every engine update, and if it cannot be made, the update does not start.

The backup file can be compressed: the “Compress database copies (gzip)” setting makes it several times smaller, and restore reads it as usual. Off by default; it needs the PHP extension zlib.

A backup on the same server dies together with the site. That is why there is System → Diagnostics → Copies off-site: the backup is encrypted before it leaves the server and goes to S3-compatible storage or over WebDAV. It needs the PHP extension sodium; you can turn the upload on only after entering your password again. The encryption key is shown once and is not stored anywhere: save it separately from the site and from the backups, because without it nobody can open a backup. You open it on your own computer, without the site: the same page has a small decryption file and instructions on how to use it. Check this once, when the first backup arrives.

Several places at once. On the same page, below, there is the “Extra storages” block: the same encrypted backup goes to every enabled storage (up to five, S3 or WebDAV) other than the main one. A failure of one does not cancel the others: if the backup did not arrive everywhere, you get a notification, and each storage shows the time of its last upload. You can “Remove” a storage from the list, but backups already sent there stay on that side. Storage keys are not shown after saving: to change them, remove the storage and add it again. The same applies if the site key was changed: the settings of the old storages can then no longer be read.

Restoring the database from a backup. On the “Database backups” page, below the list, there is the “Restore the database” block: choose a file, type its name by hand (deliberately, not with a checkbox) and confirm with your password. Restore replaces everything that is there now with what was in the backup: posts, orders and settings that appeared after it will disappear. This cannot be undone, so make a fresh backup right before restoring.

From the hosting console, the same is done by the command:

php nex1on db:restore nex1on-2026-09-08-080620.sql --yes

It first makes a backup of the current state itself, and only then overwrites it: if you picked the wrong file, you will have something to return to. If the hosting has no console, upload the same file through phpMyAdmin.

Site files in external storage

Settings → Media → “Files in external storage (S3)”. If you have many files or the site is on weak hosting, each new file and its sizes can additionally be put into a bucket of S3-compatible storage (Backblaze B2, Wasabi, Yandex, Selectel, AWS, MinIO). The files stay on your site as well. Off until you turn it on.

1. Create a separate bucket and a key that has write permission to that bucket only.
2. Enter the storage address (https only), region, bucket, key and secret key; the secret is stored encrypted and is not shown again.
3. If the bucket is open for reading or a CDN sits in front of it, enter “Address for visitors” and turn on “Serve files from storage”: the addresses of files that already have a copy there are built from it. Turn it off and the addresses go back to your site.
4. For files uploaded earlier, run php nex1on media:remote in the console.

Private files are never sent out. Only raster images (jpeg, png, gif, webp) and videos (mp4, webm) go; documents, archives and SVG stay with you. Delete a file on the site and its copies in the storage are removed too.

Storage type. Besides S3 you can choose WebDAV (Nextcloud, ownCloud, Yandex.Disk) and FTP. S3 and WebDAV work over https with certificate checking. FTP is for places where nothing else is available: with FTPS, PHP does not verify the certificate (protection against eavesdropping, but not against spoofing), and plain FTP sends the password in clear text, so for important sites choose S3 or WebDAV. FTP has an “FTP port” field (0 means the standard 21; 21 and 1024–65535 are allowed). Files are placed in folders by date. The owner can change the storage; a non-owner confirms with a password, and the owners receive an email about the change.

Theme editor: edit pages right in the panel

Site management → Theme editor. A ready-made theme cannot be edited: an update would overwrite it. So you make your own theme (“Create your own theme”): it is named my-…, starts empty and looks exactly like the base theme, and stores only the files you changed. Updates to the base theme still reach you.

• Turning it on. The editor is off until the site owner turns it on, with a password. The permission for it, “themes.code”, is by default held only by the owner.
• What you can edit. Tag-based templates (*.tpl.html), styles (*.css) and images (png, jpg, webp, gif; SVG is cleaned of anything unsafe). Scripts and server code cannot be edited here, by design: a mistake in a template does not bring the site down.
• How. Choose a file on the left, change it, click “Save”. A base theme file opens read-only: “Change this file” copies it into your theme. On the right is a list of tags with explanations: click a tag and it lands at the cursor.
• No need to start from scratch. In the “New file” panel there is “New file from a ready view”: choose a view (page, search, news feed and news post page, “suggest a post”, downloads, discussion, feedback, messages) and click “Create from the view”. A file appears with a working example in tags, which you then edit. If your theme is on, the site immediately shows this example instead of the ready view. Creating it again does not overwrite your edits. Login, registration, the account area and error pages cannot be replaced in your own theme: they contain forms and protection keys.
• View rules. Site management → Theme editor → View rules (owner only, the editor must be on). A rule says: this view of a page, when the page is such-and-such (a rubric by key or number, or an address like /shop/*), draw from this file of your theme. One file can serve several rules. Change the order with the arrows; a rule can be turned off. The highest priority is the post template from the news “Templates”, then the first matching rule, then the file <view>.<rubric-key>.tpl.html, then the theme’s regular view. If a rule’s file is missing, the page does not break.
• Password. Saving, renaming and deleting ask for a password if more than five minutes have passed since the last confirmation.
• Checking. Before saving, the template is checked: an extra or unclosed [if]/[each], program code, a file that is too long. Errors are shown with the line number; while there are any, the file is not saved.
• Preview and versions. “Preview” shows the draft in a closed window without saving anything. Each file has a list of earlier versions: “Return to this” restores the file, and the current text stays in the history.
• If things got worse. “Delete the file” removes it from your theme: the page again takes the file of the base theme, and the text stays in the history.