From fc2c08d47b03bbf9e4ea9dce5351c5f413dac4d9 Mon Sep 17 00:00:00 2001
From: adam <adam@adbraun.lol>
Date: Fri, 2 Oct 2026 22:26:56 +0000
Subject: [PATCH] add doctor, scheduled backups and fetch; release 0.0.12

- doctor [<name>] [--fix]: checks the system (user, programs, folders,
  zips, units and leftover copies in /etc, sandbox access to moved
  folders, journal, polkit, daemon, orphaned boot links and schedules)
  and each instance (ownership, server zip, config paths, mods, ports,
  failed starts/backups), with a fix for each. --fix applies the safe
  ones and re-checks them.
- backup enable|disable|now|list: a systemd timer per instance
  (terraria-backup@.timer, Persistent=), saving the world first, into
  /var/lib/terraria/backups/<name>/ (group-readable), pruning only
  scheduled backups. rename carries the schedule, delete removes it.
  upgrade's backups move there too.
- fetch vanilla|tmodloader [<version>] [--list] [--upgrade <name>]:
  downloads from terraria.org / tModLoader's GitHub releases, checks
  GitHub's sha256 and the zip, names it with its version.
- terractld may write /etc/systemd/system, for backup enable and
  doctor --fix over --host.
- Units, tmpfiles, packaging, completion, docs and changelog.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 CHANGELOG.md                     |  17 +-
 Makefile                         |   9 +-
 README.md                        |   4 +-
 bin/terractl                     | 936 +++++++++++++++++++++++++++++--
 completions/bash/terractl        |  39 +-
 config/default/terractl          |   3 +
 config/tmpfiles.d/terractl.conf  |   3 +
 docs/guide.md                    | 120 +++-
 lib/terractl-remote              |   2 +-
 packaging/deb/postrm             |   3 +
 packaging/deb/prerm              |   1 +
 systemd/terractld.service        |   2 +
 systemd/terraria-backup@.service |  22 +
 systemd/terraria-backup@.timer   |  13 +
 14 files changed, 1118 insertions(+), 56 deletions(-)
 create mode 100644 systemd/terraria-backup@.service
 create mode 100644 systemd/terraria-backup@.timer

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 2c924c7..54c79fb 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,10 +1,23 @@
 # Changelog
 
-## 0.0.12 - unreleased
+## 0.0.12 - 2026-10-02
 
+- New `fetch` command to download server zips into `dist/`, named with their version:
+  - `terractl fetch tmodloader [<version>]` downloads from tModLoader's GitHub releases (default: the latest stable) and checks it against the SHA-256 checksum GitHub publishes. `terractl fetch vanilla [<version>]` downloads from terraria.org (default: its newest; older versions by number, `1449` or `1.4.4.9`).
+  - `--list` shows the versions available (tModLoader: stable and preview), and which are already downloaded. `--upgrade <name>` switches an instance to the zip with `upgrade` right after.
+  - Every zip is checked (complete, and the right kind) before it's put in `dist/`; zips already there aren't downloaded again. If a site doesn't have the version or can't be reached, it says so and where to download it by hand.
+  - Members of the `terraria` group can use it without `sudo` (except `--upgrade`). Needs `curl`.
+- Scheduled backups, with a systemd timer per instance (`terraria-backup@<name>.timer`):
+  - `sudo terractl backup enable <name> [--every <when>] [--keep <number>]` (default: daily, keeping the newest 14). `--every` takes `hourly`, `daily`, `weekly`, a time such as `04:30`, or any systemd calendar expression. Missed backups are made after the machine starts again.
+  - `backup now <name>` makes one immediately, `backup disable <name>` stops the schedule (existing backups are kept), and `backup list [<name>]` shows schedules, the last and next run, and the backups.
+  - Each backup saves the world first if the server is running (as `export` does) and goes in `/var/lib/terraria/backups/<name>/` (`TERRARIA_BACKUPS` in `/etc/default/terractl`), readable by the `terraria` group. Only scheduled backups are pruned.
+  - `rename` takes the schedule along, `delete` turns it off, and purging the package removes the schedules (not the backups).
+- New `doctor` command: `terractl doctor [<name>] [--fix]` checks the system (user, programs including ICU and curl, folders, zips, the systemd units and old copies in `/etc` that replace them, sandbox access to moved folders, journal access, polkit, the daemon, leftovers of deleted instances) and each instance (file ownership and modes, its server zip, paths in `serverconfig.txt`, missing mods, shared ports, failed starts and backups). Each problem comes with the command that fixes it. `--fix` applies the safe fixes: `fix-perms`, folder and zip permissions, journal access, the `ReadWritePaths=` drop-in for moved folders, and boot links or backup schedules of instances that are gone. It exits with status 1 if a problem remains.
+- The daemon (`terractld.service`) may now write to `/etc/systemd/system`, so `backup enable` and `doctor --fix` also work through `--host`.
+- Warnings about moved folders now also suggest `terractl doctor --fix`.
 - New `upgrade` command to change an instance's server version, up or down:
   - `terractl upgrade <name>` lists the zips in `dist/` for its type, marking the installed, pinned and newest ones. The `terraria` group can use it without `sudo`.
-  - `sudo terractl upgrade <name> <zip>|latest` checks the zip first (right type, readable by `terraria`, contains the server, passes `unzip -t`), stops the server (saving the world), backs up its worlds and configs to `instances/.backups/`, pins `ZIP=`, unpacks the zip right away and starts the server again if it was running. If unpacking fails, the instance is left as it was. `--no-backup` skips the backup.
+  - `sudo terractl upgrade <name> <zip>|latest` checks the zip first (right type, readable by `terraria`, contains the server, passes `unzip -t`), stops the server (saving the world), backs up its worlds and configs to `/var/lib/terraria/backups/<name>/`, pins `ZIP=`, unpacks the zip right away and starts the server again if it was running. If unpacking fails, the instance is left as it was. `--no-backup` skips the backup.
   - Going to an older version needs `--downgrade`, because worlds saved by a newer version can't be opened by an older one.
   - Bash completion offers the instance's zips. Works with `--host`.
 - `reinstall` now always unpacks the **same** version again. Before, an instance with a blank `ZIP=` picked the newest zip in `dist/`, so `reinstall` could silently upgrade it. It now pins the zip the instance runs first, and refuses if that zip is gone from `dist/`. It also keeps the record of the installed version (`server/.installed`) until the new unpack is done.
diff --git a/Makefile b/Makefile
index 9ac0ca7..f23047b 100644
--- a/Makefile
+++ b/Makefile
@@ -64,7 +64,10 @@ install:
 	install -m 755 lib/terractl-remote $(DESTDIR)$(PKGLIBDIR)/terractl-remote
 	$(SUBST) systemd/terraria@.service > $(DESTDIR)$(UNITDIR)/terraria@.service
 	$(SUBST) systemd/terractld.service > $(DESTDIR)$(UNITDIR)/terractld.service
-	chmod 644 $(DESTDIR)$(UNITDIR)/terraria@.service $(DESTDIR)$(UNITDIR)/terractld.service
+	$(SUBST) systemd/terraria-backup@.service > $(DESTDIR)$(UNITDIR)/terraria-backup@.service
+	$(SUBST) systemd/terraria-backup@.timer > $(DESTDIR)$(UNITDIR)/terraria-backup@.timer
+	chmod 644 $(DESTDIR)$(UNITDIR)/terraria@.service $(DESTDIR)$(UNITDIR)/terractld.service \
+		$(DESTDIR)$(UNITDIR)/terraria-backup@.service $(DESTDIR)$(UNITDIR)/terraria-backup@.timer
 	install -m 644 systemd/terraria@.socket $(DESTDIR)$(UNITDIR)/
 	install -m 644 config/sysusers.d/terractl.conf $(DESTDIR)$(SYSUSERSDIR)/
 	install -m 644 config/tmpfiles.d/terractl.conf $(DESTDIR)$(TMPFILESDIR)/
@@ -97,10 +100,14 @@ install:
 uninstall:
 	@if [ -z "$(DESTDIR)" ] && [ -d /run/systemd/system ]; then \
 		systemctl disable --now terractld.service 2>/dev/null || true; \
+		for t in $$(systemctl list-unit-files --plain --no-legend 'terraria-backup@*.timer' | awk '{print $$1}'); do \
+			systemctl disable --now "$$t" 2>/dev/null || true; \
+		done; \
 	fi
 	rm -f $(DESTDIR)$(BINDIR)/terractl \
 		$(DESTDIR)$(UNITDIR)/terraria@.service $(DESTDIR)$(UNITDIR)/terraria@.socket \
 		$(DESTDIR)$(UNITDIR)/terractld.service \
+		$(DESTDIR)$(UNITDIR)/terraria-backup@.service $(DESTDIR)$(UNITDIR)/terraria-backup@.timer \
 		$(DESTDIR)$(SYSUSERSDIR)/terractl.conf $(DESTDIR)$(TMPFILESDIR)/terractl.conf \
 		$(DESTDIR)$(COMPLETIONDIR)/terractl $(DESTDIR)$(POLKITDIR)/50-terractl.rules
 	rm -rf $(DESTDIR)$(DOCDIR) $(DESTDIR)$(DATADIR) $(DESTDIR)$(PKGLIBDIR)
diff --git a/README.md b/README.md
index ae12737..070dd44 100644
--- a/README.md
+++ b/README.md
@@ -13,12 +13,14 @@ sudo terractl attach calamity
 
 - **Many servers, one host.** Each instance is `terraria@<name>.service`, with its own directory, port, world and mods.
 - **Vanilla and tModLoader side by side**, chosen per instance.
-- **No manual installs.** Drop the official server zips into `/var/lib/terraria/dist`; they're unpacked on demand, and each instance can be pinned to a specific version. `terractl upgrade` checks a new zip, backs up the worlds and switches version in one step.
+- **No manual installs.** `terractl fetch` downloads official Terraria and tModLoader server zips (or drop them into `/var/lib/terraria/dist` yourself); they're unpacked on demand, and each instance can be pinned to a specific version. `terractl upgrade` checks a new zip, backs up the worlds and switches version in one step.
 - **Safe shutdowns.** Stopping a server saves the world first.
 - **A live console.** `terractl attach` shows the server's output and lets you type commands into it; `terractl watch` just shows the output.
 - **Mod management.** `terractl mods` installs, enables and removes mods, with correct file ownership.
 - **Tab completion** for commands, instance names, mods and console commands.
 - **Export and import.** Pack an instance into one `.tar.gz` for backups or moving to another machine, and import it anywhere, with paths, ports and ownership adjusted.
+- **Scheduled backups.** `terractl backup enable <name>` backs an instance up daily (or on any schedule) with a systemd timer, saving the world first and keeping the newest 14.
+- **Self-check.** `terractl doctor` checks the whole setup, explains what's wrong with the command to fix it, and `--fix` fixes what it safely can.
 - **Manage other hosts.** Run any command on another host with `terractl --host nas ...`, and copy or move instances between hosts with `terractl copy` and `terractl move`, like LXD/Incus remotes. Hosts opt in by running the `terractld` daemon; access is per computer, over pinned TLS.
 - **Hardened.** Servers run as an unprivileged `terraria` user and can only write to their own data.
 - **Access for moderators.** Members of the `terraria` group can start, stop and restart servers, use the console and read the servers' own logs, without `sudo` and without seeing the rest of the system's logs.
diff --git a/bin/terractl b/bin/terractl
index 1812790..729a26a 100755
--- a/bin/terractl
+++ b/bin/terractl
@@ -10,6 +10,7 @@
 #       serverconfig.txt                      normal Terraria server config (port, world, ...)
 #       server/                               unpacked server binaries (replaceable)
 #       data/                                 worlds, mods, player data (kept across reinstalls)
+#   /var/lib/terraria/backups/<instance>/     backups ('backup', and 'upgrade' before switching)
 #
 # Managing other hosts (--host, remote, daemon, copy, move) is done by
 # terractl-remote, in Python; see run_remote_helper.
@@ -32,6 +33,7 @@ if [[ -r /etc/default/terractl ]]; then . /etc/default/terractl; fi
 
 BASE_DIR="${TERRARIA_BASE:-/var/lib/terraria/instances}"
 DIST_DIR="${TERRARIA_DIST:-/var/lib/terraria/dist}"
+BACKUP_DIR="${TERRARIA_BACKUPS:-/var/lib/terraria/backups}"
 RUN_DIR="/run/terraria"
 SVC_USER="${TERRARIA_USER:-terraria}"
 STOP_TIMEOUT="${TERRARIA_STOP_TIMEOUT:-80}"   # keep below TimeoutStopSec
@@ -40,6 +42,15 @@ TERRACTL_VERSION="@VERSION@"                  # filled in by 'make install' / 'm
 REMOTE_HELPER="@PKGLIBDIR@/terractl-remote"   # likewise
 
 die() { echo "terractl: $*" >&2; exit 1; }
+# join_by <separator> <item>...: the items with the separator between them
+join_by() {
+  local sep=$1 first
+  shift
+  if [[ $# -eq 0 ]]; then echo; return 0; fi
+  first=$1; shift
+  printf '%s' "$first" "${@/#/$sep}"
+  echo
+}
 log() { echo "terractl: $*" >&2; }
 
 # Is <user> (default: whoever runs this) in the terraria group?
@@ -83,6 +94,16 @@ Admin commands:
                                            change its server version now (backs up worlds first)
   reinstall <name> [--clean]               re-unpack the same server version on next start
                                            (--clean also re-downloads tModLoader's .NET)
+  fetch vanilla|tmodloader [<version>] [--upgrade <name>]
+                                           download a server zip into dist/ (default: latest)
+  fetch vanilla|tmodloader --list          versions available to download
+  backup enable <name> [--every <when>] [--keep <n>]
+                                           back up on a schedule (default: daily, keep 14)
+  backup disable <name>                    stop scheduled backups (keeps existing ones)
+  backup now <name>                        back up now
+  backup list [<name>]                     show schedules and backups
+  doctor [<name>] [--fix]                  check the setup and explain problems
+                                           (--fix: fix what can be fixed safely)
   fix-perms <name>                         give all of an instance's files back to the
                                            '$SVC_USER' user, with the usual modes (run as root)
   mods <name> [list]                       show installed mods and whether they're enabled
@@ -602,6 +623,10 @@ cmd_delete() {
     systemctl disable --now "terraria@$name.service" 2>/dev/null || true
     systemctl stop "terraria@$name.socket" 2>/dev/null || true
     systemctl reset-failed "terraria@$name.service" "terraria@$name.socket" 2>/dev/null || true
+    if [[ -n $(backup_schedule "$name") ]]; then
+      backup_disable "$name" >/dev/null
+      echo "turned off scheduled backups of '$name'"
+    fi
   fi
   if instance_running "$name"; then
     die "'$name' is still running outside systemd (e.g. 'terractl run' in another terminal); stop it, then run delete again"
@@ -624,7 +649,7 @@ cmd_delete() {
 # Gives an instance a new name: its folder, the paths in serverconfig.txt, and
 # its service (stopped and started again, and still starting at boot if it did).
 cmd_rename() {
-  local name=$1 new=${2:-} dir newdir state enabled
+  local name=$1 new=${2:-} dir newdir state enabled sched every keep
   [[ $# -eq 2 ]] || die "usage: terractl rename <name> <new name>"
   valid_name "$new"
   [[ $EUID -eq 0 ]] || die "rename must be run as root: sudo terractl rename $name $new"
@@ -642,11 +667,19 @@ cmd_rename() {
   fi
   if [[ $enabled == enabled ]]; then systemctl disable -q "terraria@$name"; fi
   systemctl reset-failed "terraria@$name.service" "terraria@$name.socket" 2>/dev/null || true
+  sched=$(backup_schedule "$name")
+  if [[ -n $sched ]]; then backup_disable "$name" >/dev/null; fi
   mv "$dir" "$newdir"
   if [[ -f $newdir/serverconfig.txt ]]; then
     sed -i -E "s#^(world|worldpath|banlist)=.*/data/#\1=$newdir/data/#" "$newdir/serverconfig.txt"
   fi
   echo "renamed '$name' to '$new'"
+  if [[ -n $sched ]]; then
+    IFS=$'\t' read -r every keep <<< "$sched"
+    backup_enable "$new" --every "$every" --keep "$keep" >/dev/null
+    echo "scheduled backups now run for '$new'"
+    if [[ -d $BACKUP_DIR/$name ]]; then echo "backups made before the rename stay in $BACKUP_DIR/$name"; fi
+  fi
   if [[ $enabled == enabled ]]; then systemctl enable -q "terraria@$new"; echo "terraria@$new starts at boot"; fi
   if [[ $state == active || $state == activating || $state == reloading ]]; then
     systemctl start "terraria@$new"
@@ -1153,38 +1186,51 @@ unit_path_problem() {
   esac
 }
 
-# Warns about one unit: location_warning <unit> <name to edit> <who it breaks>
-#   <dist access needed>
-location_warning() {
-  local unit=$1 edit=$2 effect=$3 dist_need=$4 what path need problem home=0 where=""
-  local -a lines=() rw=()
+# What's wrong for one unit: location_problems <unit> <name to edit> <what
+# breaks> <dist access needed>. Fills LOC_PROBLEMS (messages), LOC_RW (paths
+# for ReadWritePaths=) and LOC_HOME (1 if ProtectHome= must change).
+location_problems() {
+  local unit=$1 edit=$2 effect=$3 dist_need=$4 what path need problem
+  LOC_PROBLEMS=() LOC_RW=() LOC_HOME=0
   for what in TERRARIA_BASE TERRARIA_DIST; do
     if [[ $what == TERRARIA_BASE ]]; then path=$BASE_DIR need=rw; else path=$DIST_DIR need=$dist_need; fi
     problem=$(unit_path_problem "$unit" "$path" "$need")
     case $problem in
       home)
-        lines+=("$edit hides $path ($what) under ProtectHome=, so $effect")
-        home=1
-        if [[ $need == rw ]]; then rw+=("$path"); fi ;;
+        LOC_PROBLEMS+=("$edit hides $path ($what) under ProtectHome=, so $effect")
+        LOC_HOME=1
+        if [[ $need == rw ]]; then LOC_RW+=("$path"); fi ;;
       home-ro|system)
-        lines+=("$edit can't write to $path ($what), so $effect")
-        if [[ $problem == home-ro ]]; then home=1; fi
-        rw+=("$path") ;;
+        LOC_PROBLEMS+=("$edit can't write to $path ($what), so $effect")
+        if [[ $problem == home-ro ]]; then LOC_HOME=1; fi
+        LOC_RW+=("$path") ;;
     esac
   done
-  [[ ${#lines[@]} -gt 0 ]] || return 0
+}
+
+# The drop-in that fixes what location_problems found
+location_dropin() {
+  local path
+  echo "[Service]"
+  if [[ $LOC_HOME -eq 1 ]]; then echo "ProtectHome=read-only"; fi
+  for path in "${LOC_RW[@]}"; do echo "ReadWritePaths=$path"; done
+}
+
+# Warns about one unit, with the drop-in to add; arguments as location_problems
+location_warning() {
+  local edit=$2 where=""
+  location_problems "$@"
+  [[ ${#LOC_PROBLEMS[@]} -gt 0 ]] || return 0
   if [[ -n ${TERRACTL_VIA:-} ]]; then where=" (on $(hostname 2>/dev/null || echo that host))"; fi
-  printf 'terractl: warning: %s\n' "${lines[@]}" >&2
+  printf 'terractl: warning: %s\n' "${LOC_PROBLEMS[@]}" >&2
   {
     echo "  Fix it with a drop-in$where: sudo systemctl edit $edit"
-    echo "    [Service]"
-    if [[ $home -eq 1 ]]; then echo "    ProtectHome=read-only"; fi
-    for path in "${rw[@]}"; do echo "    ReadWritePaths=$path"; done
-    if [[ $home -eq 1 ]]; then
+    location_dropin | sed 's/^/    /'
+    if [[ $LOC_HOME -eq 1 ]]; then
       echo "  The '$SVC_USER' user also needs access to every folder above it; see"
       echo "  \"Instances or zips under /home\" in the guide."
     else
-      echo "  See \"Changing locations\" in the guide."
+      echo "  See \"Changing locations\" in the guide, or run: $(hint root doctor --fix)"
     fi
   } >&2
 }
@@ -1226,6 +1272,29 @@ cmd_list() {
 # A pin (ZIP= in instance.conf) that differs from it makes the next start (the
 # 'prepare' step) unpack the pinned zip instead.
 
+# Checks that <file> is a complete server zip of <type>; dies saying what's wrong
+check_server_zip() {
+  local f=$1 type=$2 listing
+  command -v unzip >/dev/null || die "unzip is not installed"
+  listing=$(unzip -Z1 "$f" 2>/dev/null) || die "$f isn't a readable zip (damaged, or not fully downloaded?)"
+  case $type in
+    vanilla)    grep -q '/Linux/TerrariaServer\.bin\.x86_64$' <<< "$listing" ||
+                  die "$f has no Linux/TerrariaServer.bin.x86_64; is it the dedicated server zip?" ;;
+    tmodloader) grep -qE '(^|/)start-tModLoaderServer\.sh$' <<< "$listing" ||
+                  die "$f has no start-tModLoaderServer.sh; is it a tModLoader release zip?" ;;
+  esac
+  log "checking $(basename "$f")..."
+  unzip -tqq "$f" >/dev/null 2>&1 || die "$f is damaged (unzip -t found errors); download it again"
+}
+
+# The version in a zip's name: tModLoader-v2026.07.3.0.zip -> 2026.07.3.0,
+# terraria-server-1458.zip -> 1458
+zip_version() {
+  local v=${1%.zip}
+  v=${v#terraria-server-}; v=${v#tModLoader}; v=${v#-}; v=${v#v}
+  echo "$v"
+}
+
 zip_pattern() {
   case $TYPE in
     vanilla)    echo 'terraria-server-*.zip' ;;
@@ -1326,7 +1395,7 @@ upgrade_list() {
 # that fails before the new server/ is in place leaves the instance as it was.
 cmd_upgrade() {
   local name=$1; shift
-  local target="" downgrade=0 backup=1 arg dir installed zip f listing lower verb state
+  local target="" downgrade=0 backup=1 arg dir installed zip f lower verb state
   local was_running=0 installed_name old_pin backup_file="" unit="terraria@$name"
   for arg in "$@"; do
     case $arg in
@@ -1381,17 +1450,8 @@ cmd_upgrade() {
     verb=switched
   fi
 
-  command -v unzip >/dev/null || die "unzip is not installed"
   need_svc_can_run_self "upgrade"
-  listing=$(unzip -Z1 "$f" 2>/dev/null) || die "$f isn't a readable zip (damaged, or not fully downloaded?)"
-  case $TYPE in
-    vanilla)    grep -q '/Linux/TerrariaServer\.bin\.x86_64$' <<< "$listing" ||
-                  die "$f has no Linux/TerrariaServer.bin.x86_64; is it the dedicated server zip?" ;;
-    tmodloader) grep -qE '(^|/)start-tModLoaderServer\.sh$' <<< "$listing" ||
-                  die "$f has no start-tModLoaderServer.sh; is it a tModLoader release zip?" ;;
-  esac
-  log "checking $zip..."
-  unzip -tqq "$f" >/dev/null 2>&1 || die "$f is damaged (unzip -t found errors); download it again"
+  check_server_zip "$f" "$TYPE"
 
   state=$(systemctl is-active "$unit" 2>/dev/null || true)
   if [[ $state == inactive || $state == failed ]] && instance_running "$name"; then
@@ -1404,14 +1464,8 @@ cmd_upgrade() {
   fi
 
   if [[ $backup -eq 1 ]]; then
-    mkdir -p "$BASE_DIR/.backups"
-    chmod 700 "$BASE_DIR/.backups"
     installed_name=${installed%.zip}
-    backup_file="$BASE_DIR/.backups/$name-$(date +%Y%m%d-%H%M%S)-${installed_name:-new}"
-    while [[ -e $backup_file.tar.gz ]]; do backup_file+=_; done
-    backup_file+=.tar.gz
-    # In a subshell, so a failure comes back here instead of exiting
-    if ! ( trap cleanup EXIT; cmd_export "$name" "$backup_file" ) >/dev/null; then
+    if ! backup_file=$(make_backup "$name" "before-${installed_name:-upgrade}"); then
       if [[ $was_running -eq 1 ]]; then systemctl start "$unit"; echo "$unit started again"; fi
       die "backing up '$name' failed, so its version wasn't changed"
     fi
@@ -1439,7 +1493,7 @@ cmd_upgrade() {
   if [[ $TYPE == tmodloader ]]; then
     echo "Check that its mods still load: $(hint group watch "$name")"
   fi
-  if [[ -n $backup_file ]]; then
+  if [[ -n $backup_file && -n $installed ]]; then
     echo "If its worlds need to go back to $installed, see 'Undoing an upgrade' in the guide."
   fi
 }
@@ -1466,6 +1520,808 @@ cmd_fix_perms() {
   echo "'$name': all files owned by $SVC_USER:$SVC_USER, readable by the '$SVC_USER' group, private to everyone else"
 }
 
+# ------------------------------------------------------------- backups ----
+# Backups go in $BACKUP_DIR/<name>/, readable by the terraria group, like the
+# instances themselves. Each is an export without server/, so 'import' restores
+# it. Scheduled ones are named <name>-<date>-<time>.tar.gz, and only those are
+# pruned; the ones 'upgrade' makes have a label after the time and are kept.
+#
+# A schedule is a systemd timer per instance (terraria-backup@<name>.timer). Its
+# settings are in two drop-ins that 'backup enable' writes: when (OnCalendar=)
+# and how many to keep (TERRACTL_BACKUP_KEEP).
+SYSTEMD_ETC=/etc/systemd/system
+
+backup_timer_conf()   { echo "$SYSTEMD_ETC/terraria-backup@$1.timer.d/terractl.conf"; }
+backup_service_conf() { echo "$SYSTEMD_ETC/terraria-backup@$1.service.d/terractl.conf"; }
+
+# The schedule of <name> as "<when><tab><keep>", or nothing if it has none
+backup_schedule() {
+  local conf every keep
+  conf=$(backup_timer_conf "$1")
+  [[ -r $conf ]] || return 0
+  every=$(sed -n 's/^OnCalendar=\(..*\)$/\1/p' "$conf" | tail -n 1)
+  keep=$(sed -n 's/^Environment=TERRACTL_BACKUP_KEEP=\([0-9]*\)$/\1/p' "$(backup_service_conf "$1")" 2>/dev/null | tail -n 1)
+  if [[ -n $every ]]; then printf '%s\t%s\n' "$every" "${keep:-0}"; fi
+}
+
+# Backs up <name> into $BACKUP_DIR/<name>/ and prints the file's path. An
+# optional label goes after the time. Fails (rather than exiting) if it can't.
+make_backup() {
+  local name=$1 label=${2:-} folder file d
+  folder="$BACKUP_DIR/$name"
+  for d in "$BACKUP_DIR" "$folder"; do
+    if [[ ! -d $d ]]; then install -d -m 2750 -g "$SVC_USER" "$d" || return 1; fi
+  done
+  file="$folder/$name-$(date +%Y%m%d-%H%M%S)"
+  if [[ -n $label ]]; then file+="-$label"; fi
+  while [[ -e $file.tar.gz ]]; do file+=_; done
+  file+=.tar.gz
+  # In a subshell, so a failure comes back here instead of exiting
+  ( trap cleanup EXIT; cmd_export "$name" "$file" ) >/dev/null || return 1
+  chgrp "$SVC_USER" "$file" && chmod 640 "$file"
+  echo "$file"
+}
+
+# Deletes all but the newest <keep> scheduled backups of <name> (0: keeps all)
+prune_backups() {
+  local name=$1 keep=$2 re i n
+  local -a files=()
+  [[ $keep -gt 0 && -d $BACKUP_DIR/$name ]] || return 0
+  re="${name//./\\.}-[0-9]{8}-[0-9]{6}_*\.tar\.gz"
+  mapfile -t files < <(find "$BACKUP_DIR/$name" -maxdepth 1 -type f -printf '%f\n' | grep -xE "$re" | sort)
+  n=$(( ${#files[@]} - keep ))
+  for ((i = 0; i < n; i++)); do
+    rm -f -- "$BACKUP_DIR/$name/${files[i]}"
+    echo "removed old backup ${files[i]}"
+  done
+}
+
+backup_instance() {
+  valid_name "${1:-}"
+  [[ -f $(inst_dir "$1")/instance.conf ]] || die "no instance '$1'"
+}
+
+backup_enable() {
+  local name=${1:-} every=daily keep=14 next unit
+  if [[ $# -gt 0 ]]; then shift; fi
+  while [[ $# -gt 0 ]]; do
+    case $1 in
+      --every) [[ -n ${2:-} ]] || die "--every needs a schedule, e.g. daily"; every=$2; shift ;;
+      --keep)  [[ ${2:-} =~ ^[0-9]+$ ]] || die "--keep needs a number (0 keeps them all)"; keep=$2; shift ;;
+      *) die "unknown option '$1'" ;;
+    esac
+    shift
+  done
+  [[ -n $name ]] || die "usage: terractl backup enable <name> [--every <when>] [--keep <number>]"
+  backup_instance "$name"
+  [[ $EUID -eq 0 ]] || die "'backup enable' needs root: sudo terractl backup enable $name --every '$every' --keep $keep"
+  # Goes into a unit file, where % and line breaks mean something
+  [[ $every =~ ^[A-Za-z0-9\ :*,./~+-]+$ ]] || die "'$every' isn't a schedule (e.g. daily, weekly, hourly, 04:30, 'Sun 03:00')"
+  if command -v systemd-analyze >/dev/null && ! systemd-analyze calendar "$every" >/dev/null 2>&1; then
+    die "'$every' isn't a schedule systemd understands; e.g. daily, weekly, hourly, 04:30 or 'Sun 03:00' (see: man systemd.time)"
+  fi
+  unit="terraria-backup@$name"
+  mkdir -p "$(dirname "$(backup_timer_conf "$name")")" "$(dirname "$(backup_service_conf "$name")")"
+  printf '# Written by terractl. Change it with: terractl backup enable %s --every <when>\n[Timer]\nOnCalendar=\nOnCalendar=%s\n' \
+    "$name" "$every" > "$(backup_timer_conf "$name")"
+  printf '# Written by terractl. Change it with: terractl backup enable %s --keep <number>\n[Service]\nEnvironment=TERRACTL_BACKUP_KEEP=%s\n' \
+    "$name" "$keep" > "$(backup_service_conf "$name")"
+  systemctl daemon-reload
+  systemctl enable -q "$unit.timer"
+  systemctl restart "$unit.timer"       # so a changed schedule applies now
+  if [[ $keep -eq 0 ]]; then keep="all of them"; else keep="the newest $keep"; fi
+  echo "backing up '$name' $every, keeping $keep, in $BACKUP_DIR/$name"
+  next=$(systemctl show -p NextElapseUSecRealtime --value "$unit.timer" 2>/dev/null || true)
+  if [[ -n $next && $next != n/a ]]; then echo "next backup: $next"; fi
+  echo "To make one now: $(hint root backup now "$name")"
+}
+
+backup_disable() {
+  local name=${1:-} f
+  [[ $# -eq 1 ]] || die "usage: terractl backup disable <name>"
+  valid_name "$name"
+  [[ $EUID -eq 0 ]] || die "'backup disable' needs root: sudo terractl backup disable $name"
+  systemctl disable --now -q "terraria-backup@$name.timer" 2>/dev/null || true
+  for f in "$(backup_timer_conf "$name")" "$(backup_service_conf "$name")"; do
+    rm -f "$f"
+    rmdir "$(dirname "$f")" 2>/dev/null || true      # unless someone added more there
+  done
+  systemctl daemon-reload
+  echo "no more scheduled backups of '$name'"
+  if [[ -d $BACKUP_DIR/$name ]]; then echo "its backups are kept in $BACKUP_DIR/$name"; fi
+}
+
+# Also what terraria-backup@.service runs
+backup_now() {
+  local name=${1:-} file every keep=0
+  [[ $# -eq 1 ]] || die "usage: terractl backup now <name>"
+  backup_instance "$name"
+  [[ $EUID -eq 0 ]] || die "'backup now' needs root: sudo terractl backup now $name"
+  file=$(make_backup "$name") || die "backing up '$name' failed"
+  echo "backup: $file ($(du -h "$file" | cut -f1))"
+  IFS=$'\t' read -r every keep < <(backup_schedule "$name") || true
+  prune_backups "$name" "${keep:-0}"
+}
+
+backup_list() {
+  local only=${1:-} n sched every keep last result next f size when
+  local -a names=()
+  [[ $# -le 1 ]] || die "usage: terractl backup list [<name>]"
+  if [[ -n $only ]]; then
+    valid_name "$only"; names=("$only")
+  else
+    # Instances, and backups of instances that no longer exist
+    for f in "$BASE_DIR"/*/instance.conf "$BACKUP_DIR"/*/; do
+      if [[ $f == */instance.conf && -f $f ]]; then names+=("$(basename "$(dirname "$f")")")
+      elif [[ $f == */ && -d $f ]]; then names+=("$(basename "$f")"); fi
+    done
+    mapfile -t names < <(printf '%s\n' "${names[@]}" | sort -u | grep -v '^$' || true)
+  fi
+  if [[ -d $BACKUP_DIR && ! ( -r $BACKUP_DIR && -x $BACKUP_DIR ) ]]; then
+    die "can't read $BACKUP_DIR: needs root or the '$SVC_USER' group"
+  fi
+  if [[ ${#names[@]} -eq 0 ]]; then echo "No instances or backups yet"; return 0; fi
+  for n in "${names[@]}"; do
+    sched=$(backup_schedule "$n")
+    if [[ -n $sched ]]; then
+      IFS=$'\t' read -r every keep <<< "$sched"
+      if [[ $keep -eq 0 ]]; then keep="all"; else keep="newest $keep"; fi
+      echo "$n: backed up $every, keeping $keep"
+      last=$(systemctl show -p LastTriggerUSec --value "terraria-backup@$n.timer" 2>/dev/null || true)
+      next=$(systemctl show -p NextElapseUSecRealtime --value "terraria-backup@$n.timer" 2>/dev/null || true)
+      result=$(systemctl show -p Result --value "terraria-backup@$n.service" 2>/dev/null || true)
+      if [[ -z $last || $last == n/a ]]; then last="not yet"; fi
+      if [[ -n $result && $result != success ]]; then last+=" (FAILED; see: journalctl -u terraria-backup@$n)"; fi
+      echo "  last: $last; next: ${next:-?}"
+    else
+      echo "$n: no scheduled backups"
+    fi
+    local -a rows=()
+    if [[ -d $BACKUP_DIR/$n ]]; then
+      mapfile -t rows < <(find "$BACKUP_DIR/$n" -maxdepth 1 -type f -name '*.tar.gz' \
+                            -printf '%f\t%s\t%TY-%Tm-%Td %TH:%TM\n' 2>/dev/null | sort)
+    fi
+    if [[ ${#rows[@]} -eq 0 ]]; then echo "  no backups"; continue; fi
+    for f in "${rows[@]}"; do
+      IFS=$'\t' read -r f size when <<< "$f"
+      printf '  %-58s %6s  %s\n' "$f" "$(numfmt --to=iec "$size")" "$when"
+    done
+  done
+  echo "Backups are in $BACKUP_DIR/<name>/. Restore one with: $(hint root import "<name>" "<file>")"
+}
+
+cmd_backup() {
+  local action=${1:-list}
+  if [[ $# -gt 0 ]]; then shift; fi
+  case $action in
+    enable)  backup_enable "$@" ;;
+    disable) backup_disable "$@" ;;
+    now)     backup_now "$@" ;;
+    list)    backup_list "$@" ;;
+    *)       die "unknown backup action '$action' (enable, disable, now, list)" ;;
+  esac
+}
+
+# --------------------------------------------------------------- doctor ----
+DOC_FIX=0 DOC_FAILS=0 DOC_WARNS=0 DOC_FIXABLE=0 DOC_FIXED=0 DOC_SUDO=""
+
+doc_line() {   # doc_line ok|warn|FAIL|fixed <text>
+  local tag=$1 colour="" reset=""; shift
+  if [[ -t 1 && ${TERM:-dumb} != dumb ]]; then
+    case $tag in
+      ok|fixed) colour=$'\e[32m' ;;
+      warn)     colour=$'\e[33m' ;;
+      FAIL)     colour=$'\e[31m' ;;
+    esac
+    reset=$'\e[0m'
+  fi
+  printf '  %s%-5s%s %s\n' "$colour" "$tag" "$reset" "$*"
+}
+
+doc_ok() { doc_line ok "$*"; }
+
+# doc_problem warn|FAIL <what's wrong> <how to fix it> [<command that fixes it>...]
+# With --fix, runs the command (if there is one) instead of only reporting it.
+doc_problem() {
+  local level=$1 msg=$2 fix=$3 err; shift 3
+  if [[ $# -gt 0 && $DOC_FIX -eq 1 ]]; then
+    if err=$( ( "$@" ) 2>&1 >/dev/null ); then
+      doc_line fixed "$msg"
+      DOC_FIXED=$((DOC_FIXED + 1))
+      return 0
+    fi
+    doc_line "$level" "$msg"
+    printf '        fixing it failed: %s\n' "$(tail -n 1 <<< "$err")"
+  else
+    doc_line "$level" "$msg"
+  fi
+  if [[ -n $fix ]]; then printf '        fix: %s\n' "${fix//$'\n'/$'\n'             }"; fi
+  if [[ $level == FAIL ]]; then DOC_FAILS=$((DOC_FAILS + 1)); else DOC_WARNS=$((DOC_WARNS + 1)); fi
+  if [[ $# -gt 0 ]]; then DOC_FIXABLE=$((DOC_FIXABLE + 1)); fi
+}
+
+doc_problems_so_far() { echo $((DOC_FAILS + DOC_WARNS + DOC_FIXED)); }
+
+# Can the service user do <test args> on a path? Only checkable as root.
+svc_test() { runuser -u "$SVC_USER" -- test "$@" 2>/dev/null; }
+
+# Fixes for --fix
+doc_fix_location() {   # <unit to edit> <unit to check> <what breaks> <dist access>; uses LOC_*
+  local d="$SYSTEMD_ETC/$1.d"
+  mkdir -p "$d"
+  {
+    echo "# Written by 'terractl doctor --fix', for the locations in /etc/default/terractl"
+    location_dropin
+  } > "$d/terractl-locations.conf"
+  systemctl daemon-reload
+  location_problems "$2" "$1" "$3" "$4"
+  [[ ${#LOC_PROBLEMS[@]} -eq 0 ]] || die "wrote $d/terractl-locations.conf, but systemd still doesn't allow it"
+}
+doc_fix_journal() {
+  local d
+  cmd_journal_access
+  while IFS= read -r d; do
+    if ! svc_test -r "$d" -a -x "$d" || { [[ -e $d/system.journal ]] && ! svc_test -r "$d/system.journal"; }; then
+      die "ran journal-access, but $d still isn't readable by the group"
+    fi
+  done < <(journal_dirs)
+}
+doc_fix_base() { install -d -o "$SVC_USER" -g "$SVC_USER" -m 0750 "$BASE_DIR"; chown "$SVC_USER:$SVC_USER" "$BASE_DIR"; }
+doc_fix_dist() { install -d -o root -g "$SVC_USER" -m 2775 "$DIST_DIR"; chgrp "$SVC_USER" "$DIST_DIR"; chmod 2775 "$DIST_DIR"; }
+doc_fix_backup_dir() { chgrp -R "$SVC_USER" "$BACKUP_DIR"; chmod 2750 "$BACKUP_DIR"; find "$BACKUP_DIR" -mindepth 1 -type d -exec chmod 2750 {} +; }
+doc_fix_paths() {
+  local sc; sc="$(inst_dir "$1")/serverconfig.txt"
+  sed -i -E "s#^(world|worldpath|banlist)=.*/data/#\1=$(inst_dir "$1")/data/#" "$sc"
+  fix_owner "$sc"
+}
+
+doctor_units() {
+  local spec unit label key value load frag dropins before
+  before=$(doc_problems_so_far)
+  for spec in terraria@terractl-check.service:terraria@.service terraria@terractl-check.socket:terraria@.socket \
+              terraria-backup@terractl-check.service:terraria-backup@.service \
+              terraria-backup@terractl-check.timer:terraria-backup@.timer terractld.service:terractld.service; do
+    unit=${spec%%:*} label=${spec#*:} load="" frag="" dropins=""
+    while IFS='=' read -r key value; do
+      case $key in
+        LoadState)    load=$value ;;
+        FragmentPath) frag=$value ;;
+        DropInPaths)  dropins=$value ;;
+      esac
+    done < <(systemctl show -p LoadState,FragmentPath,DropInPaths "$unit" 2>/dev/null)
+    if [[ $load != loaded ]]; then
+      doc_problem FAIL "$label isn't installed (or systemd can't load it)" "reinstall terraria-server-manager"
+    elif [[ $frag == /etc/* ]]; then
+      doc_problem FAIL "$frag replaces the package's $label (left over from a manual setup?)" \
+        "${DOC_SUDO}rm $frag && ${DOC_SUDO}systemctl daemon-reload"
+    elif [[ -n $dropins ]]; then
+      doc_ok "$label has drop-ins: $dropins"
+    fi
+  done
+  if [[ $(doc_problems_so_far) -eq $before ]]; then doc_ok "systemd units installed"; fi
+}
+
+doctor_locations() {
+  local before
+  before=$(doc_problems_so_far)
+  doctor_location_result terraria@.service terraria@terractl-check.service "servers can't start" ro
+  if systemctl is-enabled --quiet terractld.service 2>/dev/null; then
+    doctor_location_result terractld.service terractld.service "other hosts can't copy, move or import instances here" rw
+  fi
+  if [[ $(doc_problems_so_far) -eq $before ]]; then doc_ok "the services can use $BASE_DIR and $DIST_DIR"; fi
+}
+
+# doctor_location_result <unit to edit> <unit to check> <what breaks> <dist access>
+doctor_location_result() {
+  local edit=$1 msg fix
+  location_problems "$2" "$1" "$3" "$4"
+  [[ ${#LOC_PROBLEMS[@]} -gt 0 ]] || return 0
+  msg=$(join_by "; " "${LOC_PROBLEMS[@]}")
+  fix="${DOC_SUDO}systemctl edit $edit, and add:"$'\n'"$(location_dropin | sed 's/^/  /')"
+  if [[ $LOC_HOME -eq 1 ]]; then
+    # Opens up home folders, so it's left to a person to decide
+    doc_problem FAIL "$msg" "$fix"$'\n'"see \"Instances or zips under /home\" in the guide"
+  else
+    doc_problem FAIL "$msg" "$fix" doc_fix_location "$edit" "$2" "$3" "$4"
+  fi
+}
+
+doctor_system() {
+  local ldconfig tml=0 before d mode group f
+  local -a bad=() tml_confs=()
+
+  if getent passwd "$SVC_USER" >/dev/null && getent group "$SVC_USER" >/dev/null; then
+    doc_ok "user and group '$SVC_USER'"
+  else
+    doc_problem FAIL "the '$SVC_USER' user or group is missing" "${DOC_SUDO}systemd-sysusers terractl.conf" \
+      systemd-sysusers terractl.conf
+  fi
+
+  # Programs
+  before=$(doc_problems_so_far)
+  command -v unzip >/dev/null || doc_problem FAIL "unzip isn't installed, so servers can't be unpacked" "${DOC_SUDO}apt install unzip"
+  mapfile -t tml_confs < <(grep -l '^TYPE=tmodloader' "$BASE_DIR"/*/instance.conf 2>/dev/null || true)
+  tml=${#tml_confs[@]}
+  if [[ $tml -gt 0 ]]; then
+    ldconfig=$(command -v ldconfig || echo /sbin/ldconfig)
+    if ! "$ldconfig" -p 2>/dev/null | grep -q 'libicuuc\.so'; then
+      doc_problem FAIL "ICU isn't installed; tModLoader servers stop with 'Aborted' without it" "${DOC_SUDO}apt install libicu-dev"
+    fi
+    command -v curl >/dev/null ||
+      doc_problem FAIL "curl isn't installed; tModLoader servers need it to download .NET on their first start" "${DOC_SUDO}apt install curl"
+  fi
+  if [[ $(doc_problems_so_far) -eq $before ]]; then
+    doc_ok "programs$(if [[ $tml -gt 0 ]]; then echo " (including ICU and curl for tModLoader)"; fi)"
+  fi
+
+  # Folders
+  before=$(doc_problems_so_far)
+  if [[ ! -d $BASE_DIR ]]; then
+    doc_problem FAIL "$BASE_DIR (instances) doesn't exist" \
+      "${DOC_SUDO}install -d -o $SVC_USER -g $SVC_USER -m 0750 $BASE_DIR" doc_fix_base
+  else
+    read -r d group mode < <(stat -c '%U %G %a' "$BASE_DIR")
+    if [[ $d != "$SVC_USER" ]]; then
+      doc_problem warn "$BASE_DIR is owned by $d, not $SVC_USER; starting a server with a new name can't create its folder" \
+        "${DOC_SUDO}chown $SVC_USER:$SVC_USER $BASE_DIR" doc_fix_base
+    fi
+    if [[ $EUID -eq 0 ]] && ! svc_test -r "$BASE_DIR" -a -x "$BASE_DIR"; then
+      doc_problem FAIL "the '$SVC_USER' user can't get into $BASE_DIR (a folder above it is private?)" \
+        "see \"Instances or zips under /home\" in the guide"
+    fi
+  fi
+  if [[ ! -d $DIST_DIR ]]; then
+    doc_problem FAIL "$DIST_DIR (server zips) doesn't exist" \
+      "${DOC_SUDO}install -d -o root -g $SVC_USER -m 2775 $DIST_DIR" doc_fix_dist
+  else
+    read -r d group mode < <(stat -c '%U %G %a' "$DIST_DIR")
+    if [[ $EUID -eq 0 ]] && ! svc_test -r "$DIST_DIR" -a -x "$DIST_DIR"; then
+      doc_problem FAIL "the '$SVC_USER' user can't get into $DIST_DIR (a folder above it is private?)" \
+        "see \"Instances or zips under /home\" in the guide"
+    fi
+    if [[ $group != "$SVC_USER" ]] || (( (8#$mode & 8#070) != 8#070 )); then
+      doc_problem warn "members of the '$SVC_USER' group can't add zips to $DIST_DIR" \
+        "${DOC_SUDO}chgrp $SVC_USER $DIST_DIR && ${DOC_SUDO}chmod 2775 $DIST_DIR" doc_fix_dist
+    fi
+  fi
+  if [[ -d $BACKUP_DIR ]]; then
+    read -r d group mode < <(stat -c '%U %G %a' "$BACKUP_DIR")
+    if [[ $group != "$SVC_USER" ]] || (( (8#$mode & 8#050) != 8#050 )); then
+      doc_problem warn "members of the '$SVC_USER' group can't read the backups in $BACKUP_DIR" \
+        "${DOC_SUDO}chgrp -R $SVC_USER $BACKUP_DIR && ${DOC_SUDO}chmod 2750 $BACKUP_DIR" doc_fix_backup_dir
+    fi
+  fi
+  if [[ $(doc_problems_so_far) -eq $before ]]; then doc_ok "folders $BASE_DIR and $DIST_DIR"; fi
+
+  # Zips
+  mapfile -t bad < <(unreadable_zips)
+  if [[ ${#bad[@]} -gt 0 ]]; then
+    doc_problem FAIL "the '$SVC_USER' user can't read: $(printf '%s ' "${bad[@]##*/}")" \
+      "${DOC_SUDO}chmod 644 ${bad[*]@Q}" chmod 644 "${bad[@]}"
+  elif ! compgen -G "$DIST_DIR/*.zip" >/dev/null; then
+    doc_problem warn "no server zips in $DIST_DIR" "$(hint group fetch vanilla) (or tmodloader)"
+  else
+    doc_ok "server zips: $(find "$DIST_DIR" -maxdepth 1 -type f -name '*.zip' | wc -l) in $DIST_DIR"
+  fi
+
+  if ! command -v systemctl >/dev/null || [[ ! -d /run/systemd/system ]]; then
+    doc_problem FAIL "systemd isn't running here, so the servers can't run as services" ""
+    return 0
+  fi
+  doctor_units
+  doctor_locations
+
+  # The servers' journal
+  if [[ -d /var/log/journal || -d /run/log/journal ]]; then
+    local -a jdirs=()
+    mapfile -t jdirs < <(journal_dirs)
+    before=$(doc_problems_so_far)
+    if [[ ${#jdirs[@]} -eq 0 ]]; then
+      doc_problem warn "the servers' journal isn't set up yet, so the '$SVC_USER' group can't see server output" \
+        "${DOC_SUDO}terractl journal-access (also happens when a server starts)" doc_fix_journal
+    else
+      for d in "${jdirs[@]}"; do
+        f=$d/system.journal
+        if [[ $EUID -eq 0 ]]; then
+          if ! svc_test -r "$d" -a -x "$d" || { [[ -e $f ]] && ! svc_test -r "$f"; }; then
+            doc_problem FAIL "the '$SVC_USER' group can't read the servers' journal in $d" \
+              "${DOC_SUDO}terractl journal-access" doc_fix_journal
+            break
+          fi
+        elif in_group && ! can_read_journal; then
+          doc_problem FAIL "you can't read the servers' journal in $d" "${DOC_SUDO}terractl journal-access" ; break
+        fi
+      done
+      if [[ $(doc_problems_so_far) -eq $before ]]; then doc_ok "the '$SVC_USER' group can read the servers' journal"; fi
+    fi
+  fi
+
+  if [[ $(systemctl show -p LoadState --value polkit.service 2>/dev/null) != loaded ]]; then
+    doc_problem warn "polkit isn't installed, so members of the '$SVC_USER' group need sudo to start and stop servers" \
+      "${DOC_SUDO}apt install polkitd"
+  fi
+
+  if systemctl is-enabled --quiet terractld.service 2>/dev/null; then
+    if systemctl is-active --quiet terractld.service; then
+      doc_ok "the daemon for other hosts (terractld) is running"
+    else
+      doc_problem FAIL "the daemon for other hosts (terractld) is enabled but not running" \
+        "${DOC_SUDO}systemctl restart terractld; if it stops again: journalctl -u terractld" \
+        systemctl restart terractld.service
+    fi
+  fi
+
+  # Leftovers of instances that are gone
+  for f in "$SYSTEMD_ETC"/*.wants/terraria@*.service; do
+    [[ -L $f ]] || continue
+    d=${f##*/terraria@}; d=${d%.service}
+    if [[ ! -f $(inst_dir "$d")/instance.conf ]]; then
+      doc_problem warn "terraria@$d starts at boot, but there's no instance '$d'; at boot, an empty one would be created" \
+        "$(hint root disable "$d")" systemctl disable -q "terraria@$d.service"
+    fi
+  done
+  for f in "$SYSTEMD_ETC"/terraria-backup@*.timer.d; do
+    [[ -d $f ]] || continue
+    d=${f##*/terraria-backup@}; d=${d%.timer.d}
+    if [[ ! -f $(inst_dir "$d")/instance.conf ]]; then
+      doc_problem warn "scheduled backups are set up for '$d', which no longer exists" \
+        "$(hint root backup disable "$d")" backup_disable "$d"
+    fi
+  done
+}
+
+inst_port() {
+  local p
+  p=$(sed -n 's/^port=\([0-9][0-9]*\).*/\1/p' "$(inst_dir "$1")/serverconfig.txt" 2>/dev/null | tail -n 1) || true
+  echo "${p:-7777}"     # Terraria's default
+}
+
+doctor_instance() {
+  local n=$1 dir err before installed pinned zf key val wrong open pattern sc result
+  local -a missing=()
+  dir=$(inst_dir "$n")
+  before=$(doc_problems_so_far)
+  if ! err=$( (load_conf "$n") 2>&1 ); then
+    doc_problem FAIL "$n: ${err#terractl: }" "edit $dir/instance.conf"
+    return 0
+  fi
+  load_conf "$n"
+  installed=$(installed_zip "$n")
+  pattern=$(zip_pattern)
+
+  # Files the server can't change, or that others can read
+  wrong=$(find "$dir" ! -type l \( ! -user "$SVC_USER" -o ! -group "$SVC_USER" \) -printf . 2>/dev/null | wc -c)
+  open=$(find "$dir/data" "$dir/instance.conf" "$dir/serverconfig.txt" ! -type l \
+           \( -perm /o=rwx -o -perm /g=w \) -printf . 2>/dev/null | wc -c)
+  if [[ $wrong -gt 0 ]]; then
+    doc_problem FAIL "$n: $wrong files aren't owned by $SVC_USER, so the server can't change them (saving can fail)" \
+      "$(hint root fix-perms "$n")" cmd_fix_perms "$n"
+  elif [[ $open -gt 0 ]]; then
+    doc_problem warn "$n: $open of its files can be read by other users, or changed by the '$SVC_USER' group" \
+      "$(hint root fix-perms "$n")" cmd_fix_perms "$n"
+  fi
+
+  # Its server version
+  if [[ -n $ZIP ]]; then
+    pinned=${ZIP##*/}
+    if [[ $ZIP == /* ]]; then zf=$ZIP; else zf=$DIST_DIR/$ZIP; fi
+    # shellcheck disable=SC2053  # the pattern is a glob on purpose
+    if [[ $pinned != $pattern ]]; then
+      doc_problem FAIL "$n: ZIP=$pinned isn't a $TYPE zip" "$(hint root upgrade "$n") to pick one"
+    elif [[ ! -f $zf ]]; then
+      if [[ $pinned == "$installed" && ! -e $dir/server/.reinstall ]]; then
+        doc_problem warn "$n: runs $pinned, which is no longer in $DIST_DIR (fine until it needs unpacking again)" \
+          "$(hint group fetch "$TYPE" "$(zip_version "$pinned")")"
+      else
+        doc_problem FAIL "$n: ZIP=$pinned isn't in $DIST_DIR, so it can't start" \
+          "$(hint group fetch "$TYPE" "$(zip_version "$pinned")")"
+      fi
+    elif [[ -n $installed && $pinned != "$installed" ]]; then
+      doc_problem warn "$n: runs $installed, but ZIP= in instance.conf says $pinned; its next start switches without a backup" \
+        "$(hint root upgrade "$n" "$pinned") (checks the zip and backs up first)"
+    fi
+  elif [[ -z $installed ]] && ! compgen -G "$DIST_DIR/$pattern" >/dev/null; then
+    doc_problem FAIL "$n: there's no $pattern in $DIST_DIR, so it can't start" "$(hint group fetch "$TYPE")"
+  fi
+
+  # serverconfig.txt
+  sc=$dir/serverconfig.txt
+  if [[ ! -f $sc ]]; then
+    doc_problem warn "$n: has no serverconfig.txt; a default one is made when it starts" ""
+  else
+    for key in world worldpath banlist; do
+      val=$(sed -n "s/^$key=//p" "$sc" | tail -n 1)
+      if [[ -n $val && $val != "$dir/data" && $val != "$dir/data/"* ]]; then
+        if [[ $val == */data/* ]]; then
+          doc_problem warn "$n: $key= in serverconfig.txt points outside its folder ($val)" \
+            "set it to $dir/data/${val#*/data/}" doc_fix_paths "$n"
+        else
+          doc_problem warn "$n: $key= in serverconfig.txt points outside its folder ($val)" "check $sc"
+        fi
+        break
+      fi
+    done
+  fi
+
+  # Mods
+  if [[ $TYPE == tmodloader && -f $dir/data/Mods/enabled.json ]]; then
+    while IFS= read -r key; do
+      if [[ -n $key && ! -f $dir/data/Mods/$key.tmod ]]; then missing+=("$key"); fi
+    done < <(read_enabled "$dir/data/Mods")
+    if [[ ${#missing[@]} -gt 0 ]]; then
+      doc_problem warn "$n: enabled mods that aren't installed: ${missing[*]} (it fails to load mods)" \
+        "add them with $(hint root mods "$n" add "<files>"), or: $(hint root mods "$n" disable "${missing[@]}")"
+    fi
+  fi
+
+  if systemctl is-failed --quiet "terraria@$n.service" 2>/dev/null; then
+    doc_problem warn "$n: its last start failed" "see why with: $(hint group watch "$n")"
+  fi
+  if [[ -n $(backup_schedule "$n") ]]; then
+    result=$(systemctl show -p Result --value "terraria-backup@$n.service" 2>/dev/null || true)
+    if [[ -n $result && $result != success ]]; then
+      doc_problem warn "$n: its last scheduled backup failed" "journalctl -u terraria-backup@$n"
+    fi
+  fi
+
+  if [[ $(doc_problems_so_far) -eq $before ]]; then
+    doc_ok "$n ($TYPE, port $(inst_port "$n"), ${installed:-not unpacked yet})"
+  fi
+}
+
+doctor_instances() {
+  local only=$1 d n p list
+  local -a names=() clash=()
+  local -A by_port=()
+  if [[ ! -r $BASE_DIR || ! -x $BASE_DIR ]]; then
+    doc_problem warn "can't read $BASE_DIR, so instances weren't checked" "run it with sudo, or join the '$SVC_USER' group"
+    return 0
+  fi
+  for d in "$BASE_DIR"/*/; do
+    if [[ -f $d/instance.conf ]]; then names+=("$(basename "$d")"); fi
+  done
+  for n in "${names[@]}"; do
+    p=$(inst_port "$n")
+    by_port[$p]+="${by_port[$p]:+ }$n"
+  done
+  if [[ -n $only ]]; then names=("$only"); fi
+  if [[ ${#names[@]} -eq 0 ]]; then doc_ok "no instances yet (create one with: $(hint root new "<name>"))"; return 0; fi
+  for n in "${names[@]}"; do ( doctor_instance "$n"; doctor_counts ) ; doctor_merge_counts; done
+  for p in "${!by_port[@]}"; do
+    list=${by_port[$p]}
+    [[ $list == *" "* ]] || continue
+    if [[ -n $only && " $list " != *" $only "* ]]; then continue; fi
+    read -ra clash <<< "$list"
+    if [[ ${#clash[@]} -eq 2 ]]; then
+      list="${clash[0]} and ${clash[1]} both"
+    else
+      list=$(printf '%s, ' "${clash[@]:0:${#clash[@]}-1}")
+      list="${list%, } and ${clash[-1]} all"
+    fi
+    doc_problem warn "$list use port $p, so only one of them can run at a time" \
+      "change port= in the serverconfig.txt of all but one"
+  done
+}
+
+# Each instance is checked in a subshell (load_conf sets globals), so its
+# counts come back through a file
+DOC_COUNTS=""
+doctor_counts() { echo "$DOC_FAILS $DOC_WARNS $DOC_FIXABLE $DOC_FIXED" > "$DOC_COUNTS"; }
+doctor_merge_counts() { read -r DOC_FAILS DOC_WARNS DOC_FIXABLE DOC_FIXED < "$DOC_COUNTS"; }
+
+cmd_doctor() {
+  local only="" arg ver
+  for arg in "$@"; do
+    case $arg in
+      --fix) DOC_FIX=1 ;;
+      -*) die "unknown option '$arg'" ;;
+      *) [[ -z $only ]] || die "usage: terractl doctor [<name>] [--fix]"; valid_name "$arg"; only=$arg ;;
+    esac
+  done
+  if [[ $DOC_FIX -eq 1 && $EUID -ne 0 ]]; then die "'doctor --fix' needs root: sudo terractl doctor${only:+ $only} --fix"; fi
+  if [[ -n $only && -x $BASE_DIR && ! -f $(inst_dir "$only")/instance.conf ]]; then die "no instance '$only'"; fi
+  if [[ $EUID -ne 0 && -z ${TERRACTL_VIA:-} ]]; then DOC_SUDO="sudo "; fi
+  DOC_COUNTS=$(mktemp)
+  ver=$TERRACTL_VERSION; if [[ $ver == *@* ]]; then ver=development; fi
+  echo "terractl $ver on $(hostname 2>/dev/null || echo this host)"
+  if [[ $EUID -ne 0 ]]; then echo "(Not root, so some checks are skipped. For all of them: sudo terractl doctor)"; fi
+  echo
+  echo "System"
+  doctor_system
+  echo
+  echo "Instances"
+  doctor_instances "$only"
+  rm -f "$DOC_COUNTS"
+  echo
+  if [[ $((DOC_FAILS + DOC_WARNS)) -eq 0 ]]; then
+    if [[ $DOC_FIXED -gt 0 ]]; then echo "Fixed $DOC_FIXED problem(s); everything else looks fine."
+    else echo "Everything looks fine."; fi
+  else
+    echo "$DOC_FAILS problem(s), $DOC_WARNS warning(s)$(if [[ $DOC_FIXED -gt 0 ]]; then echo "; fixed $DOC_FIXED"; fi)."
+    if [[ $DOC_FIX -eq 0 && $DOC_FIXABLE -gt 0 ]]; then
+      echo "$(hint root doctor${only:+ "$only"} --fix) fixes $DOC_FIXABLE of them; the others need the steps shown."
+    fi
+  fi
+  [[ $DOC_FAILS -eq 0 ]]
+}
+
+# ---------------------------------------------------------------- fetch ----
+# Downloads official server zips into dist/, named with their version:
+# tModLoader from its GitHub releases, vanilla from terraria.org.
+TML_API="https://api.github.com/repos/tModLoader/tModLoader"
+TML_PAGE="https://github.com/tModLoader/tModLoader/releases"
+VANILLA_LIST="https://terraria.org/api/get/dedicated-servers-names"
+VANILLA_DOWNLOAD="https://terraria.org/api/download/pc-dedicated-server"
+VANILLA_PAGE="https://terraria.org (the 'PC Dedicated Server' link at the bottom)"
+
+fetch_get() {
+  curl -fsL --connect-timeout 15 --max-time 60 -A "terractl/$TERRACTL_VERSION" "$@"
+}
+
+# Dies explaining a failed download: fetch_failed <curl status> <what> <where to get it by hand>
+fetch_failed() {
+  if [[ $1 -eq 22 ]]; then
+    die "$2 isn't available there (not found, or the site refused the request). Download it by hand from $3, into $DIST_DIR"
+  fi
+  die "couldn't download $2 (curl error $1; no internet access?). Download it by hand from $3, into $DIST_DIR"
+}
+
+# tModLoader releases with a tModLoader.zip, newest first, one per line:
+# <version> stable|preview <url> <sha256, or ->. tml_releases latest|list|<version>
+tml_releases() {
+  local url json rc=0
+  case $1 in
+    latest) url="$TML_API/releases/latest" ;;
+    list)   url="$TML_API/releases?per_page=50" ;;
+    *)      url="$TML_API/releases/tags/v$1" ;;
+  esac
+  json=$(fetch_get -H 'Accept: application/vnd.github+json' "$url") || rc=$?
+  [[ $rc -eq 0 ]] || return "$rc"
+  python3 -c '
+import json, sys
+data = json.load(sys.stdin)
+for r in data if isinstance(data, list) else [data]:
+    if r.get("draft"):
+        continue
+    for a in r.get("assets", []):
+        if a.get("name") == "tModLoader.zip":
+            digest = a.get("digest") or ""
+            digest = digest[7:] if digest.startswith("sha256:") else "-"
+            print(r["tag_name"].lstrip("v"), "preview" if r.get("prerelease") else "stable",
+                  a["browser_download_url"], digest)
+' <<< "$json" | sort -rV -k1,1
+}
+
+# The newest vanilla server terraria.org offers, e.g. terraria-server-1458.zip
+vanilla_latest() {
+  local json rc=0
+  json=$(fetch_get "$VANILLA_LIST") || rc=$?
+  [[ $rc -eq 0 ]] || return "$rc"
+  python3 -c 'import json, sys; print("\n".join(json.load(sys.stdin)))' <<< "$json" |
+    grep -xE 'terraria-server-[0-9]+\.zip' | sort -V | tail -n 1
+}
+
+fetch_list() {
+  local type=$1 out rc=0 version kind url sum file note latest="" shown=0
+  if [[ $type == tmodloader ]]; then
+    out=$(tml_releases list) || rc=$?
+    [[ $rc -eq 0 ]] || fetch_failed "$rc" "the list of tModLoader releases" "$TML_PAGE"
+    printf '%-16s %-32s %s\n' VERSION FILE NOTE
+    while read -r version kind url sum; do
+      file="tModLoader-v$version.zip"
+      note=()
+      if [[ $kind == preview ]]; then note+=(preview)
+      elif [[ -z $latest ]]; then latest=$version; note+=("latest stable"); fi
+      if [[ -f $DIST_DIR/$file ]]; then note+=(downloaded); fi
+      printf '%-16s %-32s %s\n' "$version" "$file" "$(join_by ", " "${note[@]}")"
+      shown=$((shown + 1))
+      if [[ $shown -ge 15 ]]; then break; fi
+    done <<< "$out"
+    echo "Get one with: $(hint group fetch tmodloader "<version>")   (no version: the latest stable)"
+  else
+    file=$(vanilla_latest) || rc=$?
+    [[ $rc -eq 0 ]] || fetch_failed "$rc" "the list of Terraria server versions" "$VANILLA_PAGE"
+    printf '%-16s %-32s %s\n' VERSION FILE NOTE
+    latest=$file
+    if [[ -n $file ]]; then
+      note=(latest); if [[ -f $DIST_DIR/$file ]]; then note+=(downloaded); fi
+      printf '%-16s %-32s %s\n' "$(zip_version "$file")" "$file" "$(join_by ", " "${note[@]}")"
+    fi
+    for file in "$DIST_DIR"/terraria-server-*.zip; do
+      [[ -f $file && ${file##*/} != "$latest" ]] || continue
+      printf '%-16s %-32s %s\n' "$(zip_version "${file##*/}")" "${file##*/}" downloaded
+    done
+    echo "terraria.org only lists its newest version, but older ones can be fetched by number,"
+    echo "e.g. $(hint group fetch vanilla 1449)"
+  fi
+}
+
+cmd_fetch() {
+  local type="" version="" list=0 upgrade="" file url sum=- kind=stable out line rc=0 page progress
+  while [[ $# -gt 0 ]]; do
+    case $1 in
+      --list) list=1 ;;
+      --upgrade) [[ -n ${2:-} ]] || die "--upgrade needs an instance name"; upgrade=$2; shift ;;
+      -*) die "unknown option '$1'" ;;
+      *)
+        if [[ -z $type ]]; then type=$1
+        elif [[ -z $version ]]; then version=$1
+        else die "too many arguments"; fi ;;
+    esac
+    shift
+  done
+  case ${type,,} in
+    vanilla|terraria) type=vanilla page=$VANILLA_PAGE ;;
+    tmodloader|tml) type=tmodloader page=$TML_PAGE ;;
+    "") die "usage: terractl fetch vanilla|tmodloader [<version>|latest] [--upgrade <name>], or: terractl fetch vanilla|tmodloader --list" ;;
+    *) die "unknown server type '$type' (vanilla or tmodloader)" ;;
+  esac
+  command -v curl >/dev/null || die "fetch needs curl: sudo apt install curl"
+  command -v python3 >/dev/null || die "fetch needs python3: sudo apt install python3"
+  if [[ $list -eq 1 ]]; then
+    [[ -z $version && -z $upgrade ]] || die "--list doesn't take a version or --upgrade"
+    fetch_list "$type"
+    return 0
+  fi
+  if [[ -n $upgrade ]]; then
+    valid_name "$upgrade"
+    [[ $EUID -eq 0 ]] || die "--upgrade needs root: sudo terractl fetch $type ${version:-latest} --upgrade $upgrade"
+    [[ -f $(inst_dir "$upgrade")/instance.conf ]] || die "no instance '$upgrade'"
+    out=$(load_conf "$upgrade"; echo "$TYPE")
+    [[ $out == "$type" ]] || die "'$upgrade' is a $out instance, not $type"
+  fi
+  [[ -d $DIST_DIR && -w $DIST_DIR ]] || die "can't write to $DIST_DIR: fetch needs root or the '$SVC_USER' group"
+
+  version=${version:-latest}
+  if [[ $type == tmodloader ]]; then
+    version=${version#v}
+    [[ $version == latest || $version =~ ^[0-9][0-9.]*$ ]] || die "a tModLoader version looks like 2026.07.3.0"
+    out=$(tml_releases "$version") || rc=$?
+    [[ $rc -eq 0 ]] || fetch_failed "$rc" "tModLoader $version" "$TML_PAGE (see: terractl fetch tmodloader --list)"
+    line=$(head -n 1 <<< "$out")
+    [[ -n $line ]] || die "tModLoader $version has no tModLoader.zip; see: terractl fetch tmodloader --list"
+    read -r version kind url sum <<< "$line"
+    file="tModLoader-v$version.zip"
+  else
+    if [[ $version == latest ]]; then
+      file=$(vanilla_latest) || rc=$?
+      [[ $rc -eq 0 ]] || fetch_failed "$rc" "the list of Terraria server versions" "$VANILLA_PAGE"
+      [[ -n $file ]] || die "terraria.org didn't list any server versions. Download it by hand from $VANILLA_PAGE"
+    else
+      version=${version//./}
+      [[ $version =~ ^[0-9]+$ ]] || die "a vanilla version looks like 1458 or 1.4.5.8"
+      file="terraria-server-$version.zip"
+    fi
+    url="$VANILLA_DOWNLOAD/$file"
+  fi
+
+  if [[ -f $DIST_DIR/$file ]]; then
+    echo "$file is already in $DIST_DIR"
+  else
+    EXTRACT_TMP=$(mktemp -d "$DIST_DIR/.fetch.XXXXXX")      # removed by cleanup() on exit
+    log "downloading $file"
+    progress=(-sS); if [[ -t 2 ]]; then progress=(--progress-bar); fi
+    curl -fL --connect-timeout 15 --retry 2 "${progress[@]}" -A "terractl/$TERRACTL_VERSION" \
+      -o "$EXTRACT_TMP/$file" "$url" || fetch_failed $? "$file" "$page"
+    if [[ $sum != - && $(sha256sum "$EXTRACT_TMP/$file" | cut -d ' ' -f 1) != "$sum" ]]; then
+      die "$file doesn't match the checksum GitHub publishes for it; try again"
+    fi
+    check_server_zip "$EXTRACT_TMP/$file" "$type"
+    chmod 644 "$EXTRACT_TMP/$file"
+    mv -n "$EXTRACT_TMP/$file" "$DIST_DIR/$file"
+    cleanup; EXTRACT_TMP=""
+    echo "downloaded $file to $DIST_DIR ($(du -h "$DIST_DIR/$file" | cut -f1))"
+  fi
+  if [[ $kind == preview ]]; then
+    echo "Note: this is a preview release. Players need tModLoader's preview branch to join."
+  fi
+  if [[ -n $upgrade ]]; then
+    cmd_upgrade "$upgrade" "$file"
+  else
+    echo "Switch an instance to it with: $(hint root upgrade "<name>" "$file")"
+  fi
+}
+
 # key=value facts, one per line, for people and for terractl-remote (copy, move,
 # tab completion). Without a name: this host. Repeated keys are lists.
 cmd_info() {
@@ -1476,6 +2332,7 @@ cmd_info() {
     echo "host=$(hostname 2>/dev/null || echo unknown)"
     echo "base_dir=$BASE_DIR"
     echo "dist_dir=$DIST_DIR"
+    echo "backup_dir=$BACKUP_DIR"
     echo "run_dir=$RUN_DIR"
     for f in "$DIST_DIR"/*.zip; do
       if [[ -f $f ]]; then echo "dist_zip=$(basename "$f")"; fi
@@ -1531,6 +2388,9 @@ case $command in
   list) cmd_list; exit ;;
   info) if [[ $# -eq 0 ]]; then cmd_info; exit; fi ;;
   journal-access) cmd_journal_access; exit ;;
+  doctor)    cmd_doctor "$@"; exit ;;
+  backup)    cmd_backup "$@"; exit ;;
+  fetch)     cmd_fetch "$@"; exit ;;
 esac
 [[ $# -ge 1 ]] || usage
 valid_name "$1"
diff --git a/completions/bash/terractl b/completions/bash/terractl
index e053cb1..1cb9bf2 100644
--- a/completions/bash/terractl
+++ b/completions/bash/terractl
@@ -52,6 +52,11 @@ _terractl_instances() {
     fi
 }
 
+# Instance names here, or on remote <host> if one is given
+_terractl_any_instances() {
+    if [[ -n $1 ]]; then _terractl_remote_instances "$1"; else _terractl_instances; fi
+}
+
 # Remotes this user added with 'terractl remote add'
 _terractl_remotes() {
     local f=${TERRACTL_CONFIG_DIR:-${XDG_CONFIG_HOME:-$HOME/.config}/terractl}/remotes.json
@@ -125,7 +130,7 @@ _terractl() {
         cword=$COMP_CWORD
     fi
 
-    local commands="new list info start stop restart enable disable attach watch cmd mods upgrade reinstall fix-perms delete rename export import"
+    local commands="new list info start stop restart enable disable attach watch cmd mods upgrade reinstall fix-perms fetch backup doctor delete rename export import"
     local console="save say playing kick ban motd password time dawn noon dusk midnight settle seed version maxplayers port clear help"
 
     # terractl --host <remote> <command> ...: the same as on this host, except
@@ -149,7 +154,7 @@ _terractl() {
         return
     fi
 
-    local command=${words[1]}
+    local command=${words[1]} prev=${words[cword-1]}
     case $command in
         list|journal-access|help|-h|--help|version|-V|--version)
             return ;;
@@ -176,6 +181,36 @@ _terractl() {
                 _terractl_reply "enable disable status token revoke"
             fi
             return ;;
+        doctor)
+            # doctor [<name>] [--fix]
+            if [[ $cur == -* ]]; then _terractl_reply "--fix"; else _terractl_reply "$(_terractl_any_instances "$host")"; fi
+            return ;;
+        fetch)
+            # fetch vanilla|tmodloader [<version>|latest] [--list] [--upgrade <name>]
+            if (( cword == 2 )); then
+                _terractl_reply "vanilla tmodloader"
+            elif [[ $prev == --upgrade ]]; then
+                _terractl_reply "$(_terractl_any_instances "$host")"
+            elif [[ $cur == -* ]]; then
+                _terractl_reply "--list --upgrade"
+            else
+                _terractl_reply "latest"
+            fi
+            return ;;
+        backup)
+            # backup enable|disable|now|list <name> [--every <when>] [--keep <number>]
+            if (( cword == 2 )); then
+                _terractl_reply "enable disable now list"
+            elif (( cword == 3 )); then
+                _terractl_reply "$(_terractl_any_instances "$host")"
+            elif [[ ${words[2]} == enable ]]; then
+                case $prev in
+                    --every) _terractl_reply "daily weekly hourly monthly" ;;
+                    --keep)  ;;
+                    *)       _terractl_reply "--every --keep" ;;
+                esac
+            fi
+            return ;;
     esac
 
     if (( cword == 2 )); then
diff --git a/config/default/terractl b/config/default/terractl
index c8f7901..e5ae53a 100644
--- a/config/default/terractl
+++ b/config/default/terractl
@@ -13,6 +13,9 @@
 # Where server zips are read from. Outside /home, no drop-in is needed.
 #TERRARIA_DIST=/var/lib/terraria/dist
 
+# Where 'terractl backup' (and 'upgrade', before switching) puts backups
+#TERRARIA_BACKUPS=/var/lib/terraria/backups
+
 # Seconds to wait for a server to save and exit on stop (keep below 90)
 #TERRARIA_STOP_TIMEOUT=80
 
diff --git a/config/tmpfiles.d/terractl.conf b/config/tmpfiles.d/terractl.conf
index 111d3e5..49016e3 100644
--- a/config/tmpfiles.d/terractl.conf
+++ b/config/tmpfiles.d/terractl.conf
@@ -3,6 +3,9 @@ d /var/lib/terraria            0750 terraria terraria -
 d /var/lib/terraria/instances  0750 terraria terraria -
 # setgid + group-writable: members of the 'terraria' group can upload zips
 d /var/lib/terraria/dist       2775 root     terraria -
+# Backups ('terractl backup', and 'upgrade' before switching): readable by the
+# group, like the instances themselves
+d /var/lib/terraria/backups    2750 root     terraria -
 
 # The servers' journal (LogNamespace=terraria): readable by the terraria group,
 # including files journald creates later (default ACL). 'A+' only acts on paths
diff --git a/docs/guide.md b/docs/guide.md
index 547a2ed..982bc43 100644
--- a/docs/guide.md
+++ b/docs/guide.md
@@ -52,7 +52,8 @@ Everything is installed by the `terraria-server-manager` package:
 | `/usr/bin/terractl` | Helper script. The service calls it to set up, run and stop servers; you use it for everyday management. |
 | `/usr/lib/terraria-server-manager/terractl-remote` | The part of `terractl` that manages other hosts (`--host`, `remote`, `daemon`, `copy`, `move`), in Python. |
 | `/usr/lib/systemd/system/terractld.service` | The daemon that lets other hosts manage this one. Off until you turn it on (see [Managing other hosts](#managing-other-hosts)). |
-| `/etc/default/terractl` | Optional overrides (locations, stop timeout, the daemon's address). |
+| `/usr/lib/systemd/system/terraria-backup@.timer`, `terraria-backup@.service` | Scheduled backups of an instance. Off until you turn them on with `terractl backup enable` (see [Backups](#backups)). |
+| `/etc/default/terractl` | Optional overrides (locations of instances, zips and backups, stop timeout, the daemon's address). |
 | `/etc/systemd/journald@terraria.conf` | Size and retention of the servers' own journal (see [Logs](#logs)). |
 | `/usr/lib/sysusers.d/terractl.conf` | Defines the `terraria` system user. |
 | `/usr/lib/tmpfiles.d/terractl.conf` | Creates `/var/lib/terraria` and its subdirectories. |
@@ -76,6 +77,7 @@ On stop, `terractl service-stop` sends `exit` through the pipe so the world is s
 ├── dist/                             Server zips (you add these; never modified)
 │   ├── terraria-server-1458.zip
 │   └── tModLoader-v2026.07.3.0.zip
+├── backups/<name>/                   Backups from 'terractl backup' and 'upgrade' (group-readable)
 └── instances/
     ├── <name>/                       One directory per instance
     │   ├── instance.conf             Which server type and zip to use
@@ -87,7 +89,6 @@ On stop, `terractl service-stop` sends `exit` through the pipe so the world is s
     │       ├── Mods/                 tModLoader mods + enabled.json
     │       ├── ModConfigs/           tModLoader mod settings
     │       └── banlist.txt
-    ├── .backups/                     Backups made by 'terractl upgrade'
     └── .deleted/                     Backups made by 'terractl delete'
 
 /run/terraria/<name>.stdin            Console pipe (exists only while running)
@@ -326,6 +327,28 @@ The existing `terraria` user keeps `/opt/terraria` as its home directory. That's
 
 ## Server zips
 
+Servers are unpacked from the official zips in `/var/lib/terraria/dist`. The easiest way to get them there is `fetch`, which downloads them and names them with their version:
+
+```bash
+terractl fetch tmodloader                  # the latest stable tModLoader
+terractl fetch tmodloader 2026.07.3.0      # a specific version, e.g. the one your players have
+terractl fetch vanilla                     # the latest Terraria server
+terractl fetch vanilla 1449                # a specific version (1449 or 1.4.4.9)
+terractl fetch tmodloader --list           # recent tModLoader versions, stable and preview
+```
+
+tModLoader comes from its GitHub releases, and its download is checked against the checksum GitHub publishes. Vanilla comes from terraria.org, which only lists its newest version, but older ones can be fetched by number. Every zip is checked (complete, and the right kind) before it's put in `dist/`. Zips already there aren't downloaded again.
+
+`--upgrade <name>` also switches an instance to the zip it just fetched, with `upgrade` (see [Upgrading](#upgrading-or-downgrading-an-instance)):
+
+```bash
+sudo terractl fetch tmodloader --upgrade calamity
+```
+
+`fetch` needs `curl` and internet access. Members of the `terraria` group can use it without `sudo` (except `--upgrade`). If a site changes its download address and `fetch` stops working, it says so; download the zip by hand as below.
+
+### Adding zips by hand
+
 Put the official downloads in `/var/lib/terraria/dist`:
 
 | Type | File name pattern | Where to get it |
@@ -634,7 +657,7 @@ Stable tModLoader and the latest vanilla Terraria can be based on different Terr
 
 ### Upgrading (or downgrading) an instance
 
-Put the new zip in `/var/lib/terraria/dist`, with the version in its name (see [Server zips](#server-zips)). To see which zips an instance can use and which one it runs:
+Get the new zip with `terractl fetch` (or put it in `/var/lib/terraria/dist` by hand, with the version in its name; see [Server zips](#server-zips)). To see which zips an instance can use and which one it runs:
 
 ```
 $ terractl upgrade calamity
@@ -656,7 +679,7 @@ sudo terractl upgrade calamity latest
 
 1. **Checks the zip** before changing anything: it must be in `dist/`, match the instance's type, be readable by the `terraria` user, contain the server, and pass `unzip -t`. A damaged or half-downloaded zip is refused here, not on the next start.
 2. **Stops the server** if it's running. Stopping saves the world.
-3. **Backs up** the worlds and configs (not `server/`) to `/var/lib/terraria/instances/.backups/<name>-<date>-<old zip>.tar.gz`, readable only by root. Use `--no-backup` to skip this.
+3. **Backs up** the worlds and configs (not `server/`) to `/var/lib/terraria/backups/<name>/<name>-<date>-<time>-before-<old zip>.tar.gz`. Use `--no-backup` to skip this. These backups are never deleted automatically, not even by scheduled backups' `--keep`.
 4. **Pins `ZIP=`** in `instance.conf` to the new zip, so the version can't change by accident afterwards.
 5. **Unpacks the new zip** into `server/`. For tModLoader, the .NET runtime and logs are kept, as always. If this fails, the old pin is put back and the old `server/` is still in place, so the instance is exactly as it was.
 6. **Starts the server again** if it was running.
@@ -680,9 +703,9 @@ You can still change version by hand: set `ZIP=` in `instance.conf` and restart.
 To go back to the old version *and* the worlds as they were before the upgrade, replace the instance with the backup `upgrade` made. The backup is in the same format as `export`, so `import` restores it, pinned to the version it was taken with:
 
 ```bash
-sudo ls /var/lib/terraria/instances/.backups/
+terractl backup list calamity
 sudo terractl delete calamity -y        # keeps its own backup in .deleted/, just in case
-sudo terractl import calamity /var/lib/terraria/instances/.backups/calamity-20261002-213553-tModLoader-v2026.06.1.0.tar.gz
+sudo terractl import calamity /var/lib/terraria/backups/calamity/calamity-20261002-213553-before-tModLoader-v2026.06.1.0.tar.gz
 sudo terractl enable calamity --now
 ```
 
@@ -892,19 +915,42 @@ On this host, copying *from* it works for members of the `terraria` group. Copyi
 - **Revoking.** `sudo terractl daemon status` shows the trusted computers, and `sudo terractl daemon revoke laptop` takes one's access away immediately.
 - **Firewall.** The daemon doesn't need to be reachable from the internet. Limit port 7776 to your LAN or VPN, or set `TERRACTL_LISTEN` to a LAN or VPN address.
 
-The daemon runs as root, because it creates and removes instances and starts services, but with systemd's protections it can't write to `/usr`, `/boot`, `/etc` or home folders. Its certificate, key and trust list are in `/var/lib/terractl/`. Files in transit are kept in `/var/lib/terractl/transfers/`, and removed once used, after 6 hours unused, or when the daemon restarts.
+The daemon runs as root, because it creates and removes instances and starts services, but with systemd's protections it can't write to `/usr`, `/boot`, `/etc` or home folders. The one exception is `/etc/systemd/system`, where `backup enable` and `doctor --fix` write their drop-ins. Its certificate, key and trust list are in `/var/lib/terractl/`. Files in transit are kept in `/var/lib/terractl/transfers/`, and removed once used, after 6 hours unused, or when the daemon restarts.
 
 ---
 
 ## Backups
 
-Everything worth keeping is in `data/`, `instance.conf` and `serverconfig.txt`, which is exactly what `export` saves. A nightly backup kept for 14 days, as a root cron job (`sudo crontab -e`):
+Everything worth keeping is in `data/`, `instance.conf` and `serverconfig.txt`, which is exactly what a backup saves. `terractl backup` makes them on a schedule, and keeps a set number:
 
-```cron
-30 4 * * *  /usr/bin/terractl export calamity /var/backups/terraria/calamity-$(date +\%F).tar.gz && find /var/backups/terraria -name 'calamity-*.tar.gz' -mtime +14 -delete
+```bash
+sudo terractl backup enable calamity                          # daily, keeping the newest 14
+sudo terractl backup enable calamity --every 04:30 --keep 30  # every day at 4:30, keep 30
+sudo terractl backup enable calamity --every weekly --keep 0  # weekly, keep them all
+terractl backup list                                          # schedules and backups of all instances
+sudo terractl backup now calamity                             # one now
+sudo terractl backup disable calamity                         # stop (keeps existing backups)
 ```
 
-Create the folder first with `sudo mkdir -p /var/backups/terraria`. Separately, `upgrade` backs up an instance's worlds and configs before every version change (see [Undoing an upgrade](#undoing-an-upgrade)). In a crontab, `%` has a special meaning and must be written as `\%`, as above. Terraria also keeps a `.bak` copy of each world next to the world file, which is useful if the latest save is damaged.
+`--every` takes `hourly`, `daily`, `weekly`, `monthly`, a time such as `04:30`, or anything else systemd's `OnCalendar=` accepts (`'Sun 03:00'`, `'*-*-* 00/6:00'`; see `man systemd.time`). Running `backup enable` again changes the schedule.
+
+How it works:
+
+- **One systemd timer per instance**, `terraria-backup@<name>.timer`. A backup missed while the machine was off is made soon after it starts again. Backups start up to 10 minutes after the scheduled time, so several instances don't all start at once.
+- **The world is saved first** if the server is running, as `export` does, so the backup has the current state. The server keeps running.
+- **Backups go in `/var/lib/terraria/backups/<name>/`**, as `<name>-<date>-<time>.tar.gz`. Members of the `terraria` group can read them, as they can the instances themselves (`serverconfig.txt` can contain the server password). Change the folder with `TERRARIA_BACKUPS` in `/etc/default/terractl`.
+- **Only scheduled backups are deleted** when there are more than `--keep`. The ones `upgrade` makes before changing version (`...-before-<zip>.tar.gz`) and ones you put there yourself are kept.
+- **`rename` takes the schedule along**, and `delete` turns it off. Existing backups stay where they are in both cases.
+
+To restore one, import it under a new name, or replace the instance with it:
+
+```bash
+sudo terractl import calamity-restored /var/lib/terraria/backups/calamity/calamity-20261002-040512.tar.gz
+```
+
+If a scheduled backup fails, `terractl backup list` and `terractl doctor` say so; the details are in `journalctl -u terraria-backup@<name>`.
+
+Backups on the same disk don't protect against the disk failing. Copy `/var/lib/terraria/backups` elsewhere now and then, or put it on another disk (with `TERRARIA_BACKUPS`, or a mount). Terraria also keeps a `.bak` copy of each world next to the world file, which is useful if the latest save is damaged.
 
 ---
 
@@ -926,6 +972,10 @@ The servers always run as the `terraria` user. Administration is simplest with `
 | `upgrade <name> <zip>` | root only | Checked by the script. Stops and starts the server, and unpacks the zip as `terraria`. |
 | `reinstall` | root (or `terraria`) | |
 | `fix-perms` | root only | Checked by the script. |
+| `fetch` | root, or members of the `terraria` group | Writes to `dist/`, which the group may. `--upgrade` needs root. |
+| `backup list` | root, or members of the `terraria` group | |
+| `backup enable`, `disable`, `now` | root only | Checked by the script. |
+| `doctor` | anyone | Without root, the checks that need it are skipped. `--fix` needs root. |
 | `mods <name>` (list) | root, or members of the `terraria` group | |
 | `mods add/enable/disable/remove` | root (or `terraria`) | Run as root, it sets ownership of the files it installs to `terraria`. |
 | `delete`, `rename` | root only | Checked by the script. |
@@ -1002,6 +1052,44 @@ While a server runs, whether systemd started it or you did, it holds a lock on t
 
 ## Troubleshooting
 
+### Start with `doctor`
+
+`terractl doctor` checks the whole setup and explains anything that's wrong, with the command that fixes it:
+
+```
+$ sudo terractl doctor
+terractl 0.0.12 on nas
+
+System
+  ok    user and group 'terraria'
+  ok    programs (including ICU and curl for tModLoader)
+  ok    folders /var/lib/terraria/instances and /var/lib/terraria/dist
+  ok    server zips: 3 in /var/lib/terraria/dist
+  FAIL  /etc/systemd/system/terraria@.service replaces the package's terraria@.service (left over from a manual setup?)
+        fix: rm /etc/systemd/system/terraria@.service && systemctl daemon-reload
+  ok    the services can use /var/lib/terraria/instances and /var/lib/terraria/dist
+  ok    the 'terraria' group can read the servers' journal
+
+Instances
+  FAIL  calamity: 3 files aren't owned by terraria, so the server can't change them (saving can fail)
+        fix: terractl fix-perms calamity
+  ok    pvp (vanilla, port 7778, terraria-server-1458.zip)
+
+2 problem(s), 0 warning(s).
+terractl doctor --fix fixes 1 of them; the others need the steps shown.
+```
+
+It checks:
+
+- **The system:** the `terraria` user and group; `unzip`, and ICU and `curl` if there are tModLoader instances; the instances, zips and backups folders; unreadable zips; the systemd units, including old copies in `/etc/systemd/system` that replace the package's; whether the services may use the folders set in `/etc/default/terractl` (see [Changing locations](#changing-locations)); the servers' journal; polkit; the daemon, if it's on; and servers or backups that are still scheduled for instances that no longer exist.
+- **Each instance:** files the server can't change, or that others can read; its server zip (missing, wrong type, or a `ZIP=` changed by hand that hasn't been applied yet); paths in `serverconfig.txt` that point somewhere else (e.g. after copying it by hand); enabled mods that aren't installed; instances sharing a port; and failed starts or backups.
+
+`--fix` fixes what's safe to fix by itself, and says what it did: file ownership and modes (`fix-perms`), folder and zip permissions, the servers' journal access, the drop-in for moved folders, and boot links or backup schedules for instances that are gone. Everything else, such as deleting unit files or opening up home folders, is left for you, with the steps shown. `terractl doctor <name>` checks only that instance (and the system).
+
+Without `sudo`, `doctor` skips the checks that need root and says so. It exits with status 1 if it finds a problem, so it can be used in scripts and monitoring.
+
+### Common problems
+
 **tModLoader stops with `Aborted` right after "Launched Using Local Dotnet".**
 The ICU library is missing, so .NET aborts at startup. Fix it with `sudo apt install libicu-dev`, then restart the instance. To confirm, check that `ldconfig -p | grep -c libicu` prints more than 0.
 
@@ -1073,6 +1161,7 @@ Its access was revoked with `daemon revoke`, or the host's `/var/lib/terractl` w
 - common server console commands for `cmd` (`save`, `say`, `playing`, `kick`...);
 - the options of `enable`, `disable`, `watch`, `upgrade`, `reinstall`, `delete`, `export`, `copy` and `move`;
 - server zips for `upgrade`, only those of the instance's type (on a remote, all of its zips);
+- `vanilla`/`tmodloader` and the options for `fetch`, `backup` actions and schedules (`--every daily` etc.), and `--fix` for `doctor`;
 - remote names after `--host`, and `<remote>:<name>` for `copy` and `move`. Instance names on a remote are asked from its daemon, so they can take a moment;
 - `.tar.gz` files for `export` and `import`;
 - `mods` actions. For `mods add` it completes `.tmod` files and folders; for `mods enable` and `mods remove`, the installed mods; for `mods disable`, the enabled ones.
@@ -1101,6 +1190,15 @@ terractl upgrade <name> <zip>|latest [--downgrade] [--no-backup]
 terractl reinstall <name> [--clean]               Re-unpack the same version on next start
                                                   (--clean also re-downloads .NET)
 terractl fix-perms <name>                         Reset the owner and modes of all its files
+terractl fetch vanilla|tmodloader [<version>] [--upgrade <name>]
+                                                  Download a server zip (default: the latest)
+terractl fetch vanilla|tmodloader --list          Versions available to download
+terractl backup enable <name> [--every <when>] [--keep <n>]
+                                                  Back up on a schedule (default: daily, keep 14)
+terractl backup disable <name>                    Stop scheduled backups (keeps existing ones)
+terractl backup now <name>                        Back up now
+terractl backup list [<name>]                     Schedules and backups
+terractl doctor [<name>] [--fix]                  Check the setup; --fix fixes what it safely can
 terractl mods <name> [list]                       Show installed mods
 terractl mods <name> add <folder|file.tmod>...    Install and enable mods (and ModConfigs)
 terractl mods <name> enable|disable <Mod>...      Change which mods load
diff --git a/lib/terractl-remote b/lib/terractl-remote
index 956c66d..2c30ac7 100755
--- a/lib/terractl-remote
+++ b/lib/terractl-remote
@@ -325,7 +325,7 @@ def host_addresses(listen_host, port):
 # --------------------------------------------------------------- daemon ----
 
 EXEC_COMMANDS = {"list", "info", "new", "start", "stop", "restart", "enable", "disable", "cmd", "watch",
-                 "mods", "reinstall", "upgrade", "fix-perms", "delete", "rename", "export", "import",
+                 "mods", "reinstall", "upgrade", "fix-perms", "doctor", "backup", "fetch", "delete", "rename", "export", "import",
                  "-V", "--version", "version", "-h", "--help", "help"}
 
 
diff --git a/packaging/deb/postrm b/packaging/deb/postrm
index c1b4c96..b873eb6 100755
--- a/packaging/deb/postrm
+++ b/packaging/deb/postrm
@@ -6,6 +6,9 @@ case "$1" in
         # Forget which instances were enabled at boot
         rm -f /etc/systemd/system/multi-user.target.wants/terraria@*.service
         rm -rf /etc/systemd/system/terraria@.service.d
+        # Scheduled backups (the backups themselves stay in /var/lib/terraria/backups)
+        rm -f /etc/systemd/system/timers.target.wants/terraria-backup@*.timer
+        rm -rf /etc/systemd/system/terraria-backup@*.timer.d /etc/systemd/system/terraria-backup@*.service.d
         # The daemon: whether it's on, its certificate and the computers it trusts
         rm -f /etc/systemd/system/multi-user.target.wants/terractld.service
         rm -rf /etc/systemd/system/terractld.service.d /var/lib/terractl
diff --git a/packaging/deb/prerm b/packaging/deb/prerm
index f85e16f..193129d 100755
--- a/packaging/deb/prerm
+++ b/packaging/deb/prerm
@@ -8,6 +8,7 @@ case "$1" in
     remove|deconfigure)
         if [ -d /run/systemd/system ]; then
             systemctl stop terractld.service || true
+            systemctl stop 'terraria-backup@*.timer' 'terraria-backup@*.service' || true
             units=$(systemctl list-units --plain --no-legend --all 'terraria@*.service' | awk '{print $1}')
             if [ -n "$units" ]; then
                 echo "Stopping Terraria instances: $units"
diff --git a/systemd/terractld.service b/systemd/terractld.service
index 1023e32..1581923 100644
--- a/systemd/terractld.service
+++ b/systemd/terractld.service
@@ -19,6 +19,8 @@ StateDirectoryMode=0755
 # computers, like sudo terractl does. Everything else is locked down.
 NoNewPrivileges=true
 ProtectSystem=full
+# 'backup enable' and 'doctor --fix' write drop-ins for the Terraria units here
+ReadWritePaths=/etc/systemd/system
 ProtectHome=true
 PrivateTmp=true
 PrivateDevices=true
diff --git a/systemd/terraria-backup@.service b/systemd/terraria-backup@.service
new file mode 100644
index 0000000..5d5796a
--- /dev/null
+++ b/systemd/terraria-backup@.service
@@ -0,0 +1,22 @@
+[Unit]
+Description=Back up Terraria server (%i)
+Documentation=file://@DOCDIR@/README.md
+
+[Service]
+Type=oneshot
+# Saves the world first if the server is running, then archives the instance
+# (without server/) into /var/lib/terraria/backups/%i/ and removes the oldest
+# scheduled backups beyond the number to keep. Set up with:
+#   terractl backup enable %i [--every <when>] [--keep <number>]
+ExecStart=@BINDIR@/terractl backup now %i
+Nice=10
+IOSchedulingClass=idle
+
+# Runs as root, like 'sudo terractl backup now'
+NoNewPrivileges=true
+ProtectSystem=full
+PrivateTmp=true
+PrivateDevices=true
+ProtectKernelTunables=true
+ProtectKernelModules=true
+ProtectControlGroups=true
diff --git a/systemd/terraria-backup@.timer b/systemd/terraria-backup@.timer
new file mode 100644
index 0000000..d9c3abe
--- /dev/null
+++ b/systemd/terraria-backup@.timer
@@ -0,0 +1,13 @@
+[Unit]
+Description=Scheduled backups of Terraria server (%i)
+Documentation=file://@DOCDIR@/README.md
+
+[Timer]
+# 'terractl backup enable %i --every <when>' sets the schedule in a drop-in
+OnCalendar=daily
+# Catch up on a backup missed while the machine was off
+Persistent=true
+RandomizedDelaySec=10min
+
+[Install]
+WantedBy=timers.target