Airgap Storage

Sync your LOX backups to customer-controlled storage devices for true airgap protection against ransomware.

v1.0.0Updated 2026-01-01

Why Airgap Storage?

94% of ransomware attacks target backup systems. Traditional backups connected to your network can be encrypted or deleted by attackers. Airgap storage keeps your backups physically disconnected, making them impossible to compromise remotely.

No delete API - backups can only be downloaded, never modified or deleted remotely

Supported Devices

Synology NAS

DSM 7.0 or higher required

  • Native SPK package
  • Web UI integration
  • Auto-start on boot

QNAP NAS

QTS 5.0 or higher required

  • QPKG package
  • App Center installation
  • Background sync

Raspberry Pi

ARM binary with systemd service

  • Pi 3/4/5 supported
  • External USB storage
  • Low power consumption

Linux Server

Any Linux distribution

  • x86_64 and ARM64
  • Docker available
  • Systemd integration

1Register Your Device

First, register your airgap device in your LOX dashboard to get a device API key.

  1. 1Go to Dashboard → Settings → Airgap Devices
  2. 2Click Add Device and enter a name (e.g., "Office NAS")
  3. 3Select your device type (Synology, QNAP, Raspberry Pi, or Custom)
  4. 4Copy your Device API Key - you'll need this for configuration

Or use the CLI to register directly from your device:

# Register a new airgap device
lox-airgap register \
  --name "My Synology NAS" \
  --type synology_nas \
  --tenant-key "lox_your_tenant_api_key"

# Output:
# Device registered successfully!
# Device ID: ag_xxxxxxxxxxxx
# API Key: lox_device_xxxxxxxxxxxxxxxxxx
#
# Save this API key in your config file.

2Install on Synology NAS

Download SPK Package

Download the appropriate package for your NAS architecture:

Intel/AMD (x86_64)ARM (armv8)

Install via DSM Package Center:

  1. Open Package Center in DSM
  2. Click Manual Install (top right)
  3. Select the downloaded .spk file
  4. Follow the installation wizard
  5. Configure your device key in the package settings

3Install on Linux / Raspberry Pi

# Download the latest release
curl -LO https://github.com/lox-backup/lox-airgap/releases/latest/download/lox-airgap-linux-arm64.tar.gz

# Extract
tar -xzf lox-airgap-linux-arm64.tar.gz

# Install
sudo mv lox-airgap /usr/local/bin/
sudo chmod +x /usr/local/bin/lox-airgap

# Create config directory
sudo mkdir -p /etc/lox-airgap

# Create config file
sudo nano /etc/lox-airgap/config.yaml

4Configure the Daemon

Create your configuration file at /etc/lox-airgap/config.yaml:

# LOX Airgap Daemon Configuration

# API Settings
api_url: "https://backlox.com/api"
device_key: "lox_device_xxxxxxxxxxxxxxxxxx"  # Your device API key

# Storage Settings
storage_path: "/volume1/lox-backups"  # Where to store backups
storage_quota_gb: 0                    # 0 = unlimited

# Sync Settings
auto_sync: true
sync_interval_hours: 24   # How often to sync when connected
max_concurrent: 2         # Parallel downloads
retry_attempts: 3

# Security
verify_checksums: true    # Always verify SHA-256 checksums
encrypt_local: false      # Optional local encryption

# Retention
local_retention_days: 90  # How long to keep local copies

# Logging
log_level: "info"
log_file: "/var/log/lox-airgap/daemon.log"

Configuration Reference

VariableDefaultDescription
api_urlhttps://backlox.com/apiLOX API base URL
device_key-Device API key (required)
storage_path./backupsLocal backup storage directory
storage_quota_gb0Max storage in GB (0 = unlimited)
auto_synctrueAutomatic sync on schedule
sync_interval_hours24Hours between syncs
max_concurrent2Parallel download workers
retry_attempts3Download retry attempts
retry_delay_seconds30Delay between retries
verify_checksumstrueVerify SHA-256 checksums
encrypt_localfalseEncrypt local backups
local_retention_days90Days to keep local copies
log_levelinfoLog level: debug, info, warn, error

5Run the Daemon

# Run a one-time sync
lox-airgap sync

# Or run as a daemon (background mode)
lox-airgap daemon

# Check status
lox-airgap status

# List local backups
lox-airgap list

Systemd Service (Linux)

Create /etc/systemd/system/lox-airgap.service:

[Unit]
Description=LOX Airgap Backup Daemon
After=network-online.target
Wants=network-online.target

[Service]
Type=simple
ExecStart=/usr/local/bin/lox-airgap daemon
Restart=always
RestartSec=30

[Install]
WantedBy=multi-user.target
# Enable and start
sudo systemctl daemon-reload
sudo systemctl enable lox-airgap
sudo systemctl start lox-airgap

# Check logs
sudo journalctl -u lox-airgap -f

How Sync Works

1. Heartbeat

Device connects and sends heartbeat with storage status

2. Sync

Downloads pending backups with checksum verification

3. Confirm

Server records successful sync, device can go offline

Security Best Practices

  • Store your airgap device in a secure, physically separate location
  • Connect only periodically (weekly or monthly) to download new backups
  • Keep the device powered off when not syncing to prevent remote access
  • Enable local encryption if storing in an untrusted location
  • Regularly test restoration from your airgap backups

CLI Reference

CommandDescription
lox-airgap registerRegister device with LOX
lox-airgap syncRun one-time sync
lox-airgap daemonRun as background daemon
lox-airgap statusShow sync status
lox-airgap listList local backups

Next Steps

API Reference
Automate with the REST API
CLI Documentation
Full CLI reference guide