Where Does Defguard Store Config and Data?
Defguard Docker volumes, .env file and gateway TOML config for a self-hosted install.
Last updated
Defguard is server software, so the data location is the folder you ran the installer from. The one line setup script writes a docker-compose.yaml, an .env file and a .volumes directory next to it. That trio is the install. Back it up and you can rebuild the instance.
Day to day settings live in environment variables (DEFGUARD_URL, admin groups, enrollment timeouts, gRPC endpoints) rather than files you edit in place. Gateways take an optional TOML file via --config with a name and a stats period. Desktop clients hold no files worth copying: they enroll with a URL plus a one time token.
Where Defguard stores this, by platform
./.volumes
Created beside docker-compose.yaml by setup.sh. Holds .volumes/db (Postgres), .volumes/certs/edge and .volumes/certs/gateway. Keep .env alongside it: it carries generated secrets and URLs the stack needs.
Frequently asked questions
where is the Defguard gateway config file
Pass it explicitly with defguard-gateway --config gateway.toml. A minimal file sets a display name and stats_period in seconds. Everything else (interface name, gRPC URL, cert dir) can come from DEFGUARD_* environment variables.
how do I move Defguard to a new server
Copy the whole deploy directory: compose file, .env and .volumes. Recreate DNS for your Defguard domain and enrollment domain first, then bring the stack up. Clients re-enroll with fresh tokens; do not copy client WireGuard keys by hand.
Notice an outdated path? Let us know.