kumaconf 0.1.0__tar.gz

kumaconf-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 Younes Z.
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

kumaconf-0.1.0/PKG-INFO

@@ -0,0 +1,109 @@
+Metadata-Version: 2.4
+Name: kumaconf
+Version: 0.1.0
+Summary: Export the configuration of an Uptime Kuma instance from its SQLite file as JSON, and write it back into an empty instance. History is never read.
+Author: Younes Z.
+License: MIT
+Project-URL: Homepage, https://github.com/Rezarys/kumaconf
+Project-URL: Issues, https://github.com/Rezarys/kumaconf/issues
+Keywords: uptime-kuma,uptime kuma,uptime,monitoring,backup,restore,export,sqlite,self hosted
+Classifier: Development Status :: 4 - Beta
+Classifier: Environment :: Console
+Classifier: Intended Audience :: System Administrators
+Classifier: License :: OSI Approved :: MIT License
+Classifier: Programming Language :: Python :: 3
+Classifier: Topic :: System :: Monitoring
+Classifier: Topic :: System :: Archiving :: Backup
+Classifier: Topic :: Utilities
+Requires-Python: >=3.9
+Description-Content-Type: text/markdown
+License-File: LICENSE
+Dynamic: license-file
+
+# kumaconf
+
+Export the configuration of an Uptime Kuma instance from its SQLite file as JSON, and restore it into an empty instance. Nothing else is read.
+
+```
+pip install kumaconf==0.1.0
+```
+
+Read the configuration of an Uptime Kuma instance out of its SQLite file, as readable JSON, and write it back into an empty instance. Monitors, notifications, tags, status pages and settings come out. Heartbeats and statistics never do.
+
+Everything is done on the database file. There is no API call, no token, no account, no network traffic of any kind, and nothing is sent anywhere.
+
+## Look before you touch
+
+```
+kumaconf check /path/to/kuma.db
+```
+
+`check` only reads. It prints the tables it found, how many rows each one holds, the history tables it will never read, and the columns it will leave out because they hold secrets. Run it first.
+
+An instance runs its database in WAL mode, and SQLite writes a `-shm` file next to a WAL database even when it is only reading it. So the file has to sit in a directory you can write to, and a copy of `kuma.db` alone loses whatever is still in its `-wal` file. Take the copy like this, or stop the instance and copy the three files together:
+
+```
+sqlite3 kuma.db ".backup copy.db"
+```
+
+## Export
+
+```
+kumaconf export /path/to/kuma.db -o kuma-config.json
+```
+
+The output is plain JSON, one entry per table, with the column names written next to the rows. It holds configuration rows only, never history, so it stays small enough for a git repository, unlike a copy of the data directory.
+
+Passwords, tokens and notification settings are left out by default, and the command says on standard error exactly which ones it left out. If you want them in the file:
+
+```
+kumaconf export /path/to/kuma.db -o kuma-config.json --include-secrets
+```
+
+That file then holds live credentials. Treat it as a secret.
+
+A file exported without `--include-secrets` comes back with empty notification settings and empty passwords. A notification whose settings are empty will not send anything, and a status page that was password protected comes back without its password, so it comes back public. Export with `--include-secrets` if you want a restore that stands on its own, and keep that file out of git.
+
+## Import into an empty instance
+
+```
+kumaconf import /path/to/new/kuma.db kuma-config.json --dry-run
+```
+
+The dry run says what it would write and writes nothing. When it looks right, drop the flag:
+
+```
+kumaconf import /path/to/new/kuma.db kuma-config.json
+```
+
+Stop the target instance first, so that it is not writing to the file at the same time.
+
+For every table the file carries, the import refuses to run if that table already holds rows in the target, and it refuses before writing anything at all. It is a restore into a fresh install, not a merge of two instances. The one exception is the `setting` table, where a key that already exists is left exactly as it is, and only missing keys are added. Keys that look like secrets, and the keys that identify the instance itself, are never written back, even from a file exported with `--include-secrets`.
+
+Identifiers are kept, so the links between monitors, tags, notifications and status pages survive. Columns that exist in the file but not in the target database are dropped, and the command says so.
+
+## What it never touches
+
+- `heartbeat`, `stat_minutely`, `stat_hourly`, `stat_daily`, `monitor_tls_info` and `notification_sent_history`: history, never read, never written.
+- `user`, `api_key` and the `better_auth_*` tables: accounts, password hashes, two factor seeds and sessions. They belong to the instance, not to its configuration.
+- Secret columns, unless you ask for them: `basic_auth_pass`, `push_token`, `radius_password`, `radius_secret`, `oauth_client_secret`, `database_connection_string`, `headers`, `tls_key`, `kafka_producer_sasl_options`, `grpc_metadata`, the whole `config` column of `notification`, the status page password, and any setting key that looks like a secret. A column is treated as a secret when its name matches password, pass, secret, token, api key, credential, connection string, private key or two factor, plus the few above that carry a secret without saying so in their name.
+
+Note that the `body` column of a monitor is exported as it is. If you put credentials in a request body, they are in the file.
+
+## What is not verified
+
+This was written against the upstream database schema, read on 2026-09-28 from `db/knex_init_db.js` and `db/knex_migrations` of the version 2 branch. **It has not been run against a live version 2 instance**, because I do not have one. The tool reads the real tables and columns of the file you give it rather than assuming a fixed schema, and it reports anything it did not expect, but the shape of the data in a running installation is not something I have checked.
+
+This is why `check` exists, and why reading is done on a read only connection that cannot write to the database. The database file itself is never modified. Run `check` first, work on a copy of your database file, and please open an issue if what you see does not match what you expected.
+
+## Why this exists
+
+Request thread: https://github.com/louislam/uptime-kuma/issues/6045
+
+People there dump the whole database while excluding four history tables by hand, or stop the service and archive the entire data directory. This tool knows which tables to exclude, so you do not have to.
+
+## License and honesty
+
+MIT. Not affiliated with the Uptime Kuma project. Built with AI assistance, reviewed and tested by me.
+
+Tests: `python -m unittest discover -s tests -t tests` with `src` on `PYTHONPATH`.

kumaconf-0.1.0/README.md

@@ -0,0 +1,87 @@
+# kumaconf
+
+Export the configuration of an Uptime Kuma instance from its SQLite file as JSON, and restore it into an empty instance. Nothing else is read.
+
+```
+pip install kumaconf==0.1.0
+```
+
+Read the configuration of an Uptime Kuma instance out of its SQLite file, as readable JSON, and write it back into an empty instance. Monitors, notifications, tags, status pages and settings come out. Heartbeats and statistics never do.
+
+Everything is done on the database file. There is no API call, no token, no account, no network traffic of any kind, and nothing is sent anywhere.
+
+## Look before you touch
+
+```
+kumaconf check /path/to/kuma.db
+```
+
+`check` only reads. It prints the tables it found, how many rows each one holds, the history tables it will never read, and the columns it will leave out because they hold secrets. Run it first.
+
+An instance runs its database in WAL mode, and SQLite writes a `-shm` file next to a WAL database even when it is only reading it. So the file has to sit in a directory you can write to, and a copy of `kuma.db` alone loses whatever is still in its `-wal` file. Take the copy like this, or stop the instance and copy the three files together:
+
+```
+sqlite3 kuma.db ".backup copy.db"
+```
+
+## Export
+
+```
+kumaconf export /path/to/kuma.db -o kuma-config.json
+```
+
+The output is plain JSON, one entry per table, with the column names written next to the rows. It holds configuration rows only, never history, so it stays small enough for a git repository, unlike a copy of the data directory.
+
+Passwords, tokens and notification settings are left out by default, and the command says on standard error exactly which ones it left out. If you want them in the file:
+
+```
+kumaconf export /path/to/kuma.db -o kuma-config.json --include-secrets
+```
+
+That file then holds live credentials. Treat it as a secret.
+
+A file exported without `--include-secrets` comes back with empty notification settings and empty passwords. A notification whose settings are empty will not send anything, and a status page that was password protected comes back without its password, so it comes back public. Export with `--include-secrets` if you want a restore that stands on its own, and keep that file out of git.
+
+## Import into an empty instance
+
+```
+kumaconf import /path/to/new/kuma.db kuma-config.json --dry-run
+```
+
+The dry run says what it would write and writes nothing. When it looks right, drop the flag:
+
+```
+kumaconf import /path/to/new/kuma.db kuma-config.json
+```
+
+Stop the target instance first, so that it is not writing to the file at the same time.
+
+For every table the file carries, the import refuses to run if that table already holds rows in the target, and it refuses before writing anything at all. It is a restore into a fresh install, not a merge of two instances. The one exception is the `setting` table, where a key that already exists is left exactly as it is, and only missing keys are added. Keys that look like secrets, and the keys that identify the instance itself, are never written back, even from a file exported with `--include-secrets`.
+
+Identifiers are kept, so the links between monitors, tags, notifications and status pages survive. Columns that exist in the file but not in the target database are dropped, and the command says so.
+
+## What it never touches
+
+- `heartbeat`, `stat_minutely`, `stat_hourly`, `stat_daily`, `monitor_tls_info` and `notification_sent_history`: history, never read, never written.
+- `user`, `api_key` and the `better_auth_*` tables: accounts, password hashes, two factor seeds and sessions. They belong to the instance, not to its configuration.
+- Secret columns, unless you ask for them: `basic_auth_pass`, `push_token`, `radius_password`, `radius_secret`, `oauth_client_secret`, `database_connection_string`, `headers`, `tls_key`, `kafka_producer_sasl_options`, `grpc_metadata`, the whole `config` column of `notification`, the status page password, and any setting key that looks like a secret. A column is treated as a secret when its name matches password, pass, secret, token, api key, credential, connection string, private key or two factor, plus the few above that carry a secret without saying so in their name.
+
+Note that the `body` column of a monitor is exported as it is. If you put credentials in a request body, they are in the file.
+
+## What is not verified
+
+This was written against the upstream database schema, read on 2026-09-28 from `db/knex_init_db.js` and `db/knex_migrations` of the version 2 branch. **It has not been run against a live version 2 instance**, because I do not have one. The tool reads the real tables and columns of the file you give it rather than assuming a fixed schema, and it reports anything it did not expect, but the shape of the data in a running installation is not something I have checked.
+
+This is why `check` exists, and why reading is done on a read only connection that cannot write to the database. The database file itself is never modified. Run `check` first, work on a copy of your database file, and please open an issue if what you see does not match what you expected.
+
+## Why this exists
+
+Request thread: https://github.com/louislam/uptime-kuma/issues/6045
+
+People there dump the whole database while excluding four history tables by hand, or stop the service and archive the entire data directory. This tool knows which tables to exclude, so you do not have to.
+
+## License and honesty
+
+MIT. Not affiliated with the Uptime Kuma project. Built with AI assistance, reviewed and tested by me.
+
+Tests: `python -m unittest discover -s tests -t tests` with `src` on `PYTHONPATH`.

kumaconf-0.1.0/pyproject.toml

@@ -0,0 +1,44 @@
+[build-system]
+requires = ["setuptools>=68"]
+build-backend = "setuptools.build_meta"
+
+[project]
+name = "kumaconf"
+version = "0.1.0"
+description = "Export the configuration of an Uptime Kuma instance from its SQLite file as JSON, and write it back into an empty instance. History is never read."
+readme = "README.md"
+requires-python = ">=3.9"
+license = { text = "MIT" }
+authors = [{ name = "Younes Z." }]
+keywords = [
+  "uptime-kuma",
+  "uptime kuma",
+  "uptime",
+  "monitoring",
+  "backup",
+  "restore",
+  "export",
+  "sqlite",
+  "self hosted",
+]
+classifiers = [
+  "Development Status :: 4 - Beta",
+  "Environment :: Console",
+  "Intended Audience :: System Administrators",
+  "License :: OSI Approved :: MIT License",
+  "Programming Language :: Python :: 3",
+  "Topic :: System :: Monitoring",
+  "Topic :: System :: Archiving :: Backup",
+  "Topic :: Utilities",
+]
+dependencies = []
+
+[project.urls]
+Homepage = "https://github.com/Rezarys/kumaconf"
+Issues = "https://github.com/Rezarys/kumaconf/issues"
+
+[project.scripts]
+kumaconf = "kumaconf.cli:main"
+
+[tool.setuptools.packages.find]
+where = ["src"]

kumaconf-0.1.0/setup.cfg

@@ -0,0 +1,4 @@
+[egg_info]
+tag_build = 
+tag_date = 0
+

kumaconf-0.1.0/src/kumaconf/__init__.py

@@ -0,0 +1,3 @@
+"""kumaconf: read the configuration of a self hosted uptime monitor out of its SQLite file."""
+
+__version__ = "0.1.0"

kumaconf-0.1.0/src/kumaconf/cli.py

@@ -0,0 +1,206 @@
+"""Command line interface."""
+
+import argparse
+import json
+import sqlite3
+import sys
+
+from . import __version__
+from .db import DatabaseError, looks_like_uptime_database, open_readonly, table_names
+from .exporter import export_config, inspect
+from .importer import ImportRefused, import_config
+
+
+def _warn_if_unexpected(path):
+    con = open_readonly(path)
+    try:
+        present = set(table_names(con))
+    finally:
+        con.close()
+    if not looks_like_uptime_database(present):
+        print(
+            "warning: this file does not carry the tables this tool expects "
+            "(monitor, setting). Reading it anyway, nothing is written.",
+            file=sys.stderr,
+        )
+
+
+def cmd_check(args):
+    _warn_if_unexpected(args.database)
+    report = inspect(args.database)
+    if args.json:
+        print(json.dumps(report, indent=2, sort_keys=True))
+        return 0
+    print("database: %s" % report["database"])
+    print("")
+    print("configuration tables read:")
+    for table in report["tables_found"]:
+        print("  %-24s %6d row(s)" % (table, report["counts"][table]))
+    if report["tables_missing"]:
+        print("")
+        print("not in this file: %s" % ", ".join(report["tables_missing"]))
+    if report["history_tables_present"]:
+        print("")
+        print(
+            "history tables found and never read: %s"
+            % ", ".join(report["history_tables_present"])
+        )
+    if report["account_tables_present"]:
+        print(
+            "account tables found and never read: %s"
+            % ", ".join(report["account_tables_present"])
+        )
+    if report["unknown_tables"]:
+        print("")
+        print(
+            "tables this version does not know about, left alone: %s"
+            % ", ".join(report["unknown_tables"])
+        )
+    if report["secret_columns"]:
+        print("")
+        print("columns left out unless you pass --include-secrets:")
+        for table in sorted(report["secret_columns"]):
+            print("  %-24s %s" % (table, ", ".join(report["secret_columns"][table])))
+    print("")
+    print("nothing was written. This command only reads.")
+    return 0
+
+
+def cmd_export(args):
+    _warn_if_unexpected(args.database)
+    document = export_config(args.database, include_secrets=args.include_secrets)
+    text = json.dumps(document, indent=2, sort_keys=False)
+    if args.output in (None, "-"):
+        print(text)
+    else:
+        with open(args.output, "w", encoding="utf-8") as handle:
+            handle.write(text + "\n")
+        counts = {t: len(v["rows"]) for t, v in document["tables"].items()}
+        total = sum(counts.values())
+        print(
+            "wrote %s: %d row(s) over %d table(s)" % (args.output, total, len(counts)),
+            file=sys.stderr,
+        )
+    if document["omitted_secrets"] and not args.include_secrets:
+        print(
+            "secrets left out: %s" % ", ".join(document["omitted_secrets"]),
+            file=sys.stderr,
+        )
+    return 0
+
+
+def cmd_import(args):
+    with open(args.file, "r", encoding="utf-8") as handle:
+        document = json.load(handle)
+    result = import_config(args.database, document, dry_run=args.dry_run)
+    head = "would insert" if args.dry_run else "inserted"
+    for table in sorted(result["inserted"]):
+        print("%s %-24s %6d row(s)" % (head, table, result["inserted"][table]))
+    for table in sorted(result["columns_dropped"]):
+        print(
+            "column(s) not in this database, dropped from %s: %s"
+            % (table, ", ".join(result["columns_dropped"][table])),
+            file=sys.stderr,
+        )
+    for table in sorted(result["columns_left_to_default"]):
+        print(
+            "column(s) absent from the file, left to their default in %s: %s"
+            % (table, ", ".join(result["columns_left_to_default"][table])),
+            file=sys.stderr,
+        )
+    if result["tables_not_in_database"]:
+        print(
+            "table(s) in the file but not in this database: %s"
+            % ", ".join(result["tables_not_in_database"]),
+            file=sys.stderr,
+        )
+    if result["settings_skipped"]:
+        print(
+            "setting key(s) not written: %s" % ", ".join(result["settings_skipped"]),
+            file=sys.stderr,
+        )
+    if result["secrets_absent_from_the_file"]:
+        print(
+            "these were left out when the file was exported, so they are not restored and have "
+            "to be typed in again: %s"
+            % ", ".join(result["secrets_absent_from_the_file"]),
+            file=sys.stderr,
+        )
+        print(
+            "a notification whose settings are empty will not send anything, and a status page "
+            "that was password protected comes back without its password.",
+            file=sys.stderr,
+        )
+    if args.dry_run:
+        print("dry run: nothing was written.")
+    return 0
+
+
+def build_parser():
+    parser = argparse.ArgumentParser(
+        prog="kumaconf",
+        description=(
+            "Read the configuration of a self hosted uptime monitor out of its SQLite file, "
+            "as readable JSON, and write it back into an empty instance. History is never read."
+        ),
+    )
+    parser.add_argument("--version", action="version", version="kumaconf %s" % __version__)
+    subparsers = parser.add_subparsers(dest="command")
+
+    check = subparsers.add_parser(
+        "check", help="show what is in the database file. Writes nothing."
+    )
+    check.add_argument("database", help="path to the SQLite file of the instance")
+    check.add_argument("--json", action="store_true", help="print the report as JSON")
+    check.set_defaults(func=cmd_check)
+
+    export = subparsers.add_parser("export", help="write the configuration as JSON")
+    export.add_argument("database", help="path to the SQLite file of the instance")
+    export.add_argument(
+        "-o", "--output", default="-", help="file to write, or - for standard output"
+    )
+    export.add_argument(
+        "--include-secrets",
+        action="store_true",
+        help="keep passwords, tokens and notification settings in the output",
+    )
+    export.set_defaults(func=cmd_export)
+
+    restore = subparsers.add_parser(
+        "import", help="write a JSON configuration into an empty instance"
+    )
+    restore.add_argument("database", help="path to the SQLite file of the empty instance")
+    restore.add_argument("file", help="the JSON file written by export")
+    restore.add_argument(
+        "--dry-run", action="store_true", help="say what would be written, write nothing"
+    )
+    restore.set_defaults(func=cmd_import)
+    return parser
+
+
+def main(argv=None):
+    parser = build_parser()
+    args = parser.parse_args(argv)
+    if getattr(args, "func", None) is None:
+        parser.print_help()
+        return 2
+    try:
+        return args.func(args)
+    except (DatabaseError, ImportRefused) as exc:
+        print("error: %s" % exc, file=sys.stderr)
+        return 1
+    except sqlite3.Error as exc:
+        print(
+            "error: sqlite could not use this file: %s. A database left in WAL mode needs to "
+            "write a -shm file next to itself even to be read, so copy it to a directory you "
+            "can write to, or take the copy with: sqlite3 kuma.db \".backup copy.db\"" % exc,
+            file=sys.stderr,
+        )
+        return 1
+    except (OSError, ValueError) as exc:
+        print("error: %s" % exc, file=sys.stderr)
+        return 1
+
+
+if __name__ == "__main__":
+    sys.exit(main())

kumaconf-0.1.0/src/kumaconf/db.py

@@ -0,0 +1,52 @@
+"""Small SQLite helpers. Reading is always done on a read only connection."""
+
+import os
+import sqlite3
+from urllib.request import pathname2url
+
+
+class DatabaseError(Exception):
+    pass
+
+
+def open_readonly(path):
+    """Open the database file without any possibility of writing to it."""
+    if not os.path.isfile(path):
+        raise DatabaseError("no such database file: %s" % path)
+    uri = "file:%s?mode=ro" % pathname2url(os.path.abspath(path))
+    try:
+        return sqlite3.connect(uri, uri=True)
+    except sqlite3.Error as exc:
+        raise DatabaseError("cannot open %s for reading: %s" % (path, exc))
+
+
+def open_readwrite(path):
+    if not os.path.isfile(path):
+        raise DatabaseError("no such database file: %s" % path)
+    try:
+        con = sqlite3.connect(path)
+    except sqlite3.Error as exc:
+        raise DatabaseError("cannot open %s: %s" % (path, exc))
+    con.execute("PRAGMA foreign_keys = ON")
+    return con
+
+
+def table_names(con):
+    rows = con.execute(
+        "SELECT name FROM sqlite_master WHERE type = 'table' ORDER BY name"
+    ).fetchall()
+    return [r[0] for r in rows]
+
+
+def column_names(con, table):
+    rows = con.execute('PRAGMA table_info("%s")' % table.replace('"', '""')).fetchall()
+    return [r[1] for r in rows]
+
+
+def row_count(con, table):
+    return con.execute('SELECT COUNT(*) FROM "%s"' % table.replace('"', '""')).fetchone()[0]
+
+
+def looks_like_uptime_database(present):
+    """True when the file carries the tables this tool was written for."""
+    return "monitor" in present and "setting" in present

kumaconf-0.1.0/src/kumaconf/exporter.py

@@ -0,0 +1,129 @@
+"""Read a configuration out of the database file. Nothing here ever writes."""
+
+import datetime
+import os
+
+from . import __version__
+from .db import DatabaseError, column_names, open_readonly, row_count, table_names
+from .schema import (
+    ACCOUNT_TABLES,
+    CONFIG_TABLES,
+    FORMAT_VERSION,
+    HISTORY_TABLES,
+    is_secret_setting_key,
+    secret_columns,
+)
+
+
+def _now():
+    return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
+
+
+def inspect(path):
+    """Read the file and describe what is in it. Used by both `check` and `export`."""
+    con = open_readonly(path)
+    try:
+        present = set(table_names(con))
+        report = {
+            "database": os.path.basename(path),
+            "tables_found": [],
+            "tables_missing": [],
+            "history_tables_present": sorted(t for t in HISTORY_TABLES if t in present),
+            "account_tables_present": sorted(t for t in ACCOUNT_TABLES if t in present),
+            "unknown_tables": sorted(
+                t
+                for t in present
+                if t not in CONFIG_TABLES
+                and t not in HISTORY_TABLES
+                and t not in ACCOUNT_TABLES
+                and not t.startswith("sqlite_")
+                and t != "knex_migrations"
+                and t != "knex_migrations_lock"
+            ),
+            "counts": {},
+            "secret_columns": {},
+        }
+        for table in CONFIG_TABLES:
+            if table not in present:
+                report["tables_missing"].append(table)
+                continue
+            report["tables_found"].append(table)
+            report["counts"][table] = row_count(con, table)
+            found = secret_columns(table, column_names(con, table))
+            if found:
+                report["secret_columns"][table] = list(found)
+        return report
+    finally:
+        con.close()
+
+
+def export_config(path, include_secrets=False):
+    """Return the configuration of the database as a plain dictionary."""
+    con = open_readonly(path)
+    try:
+        present = set(table_names(con))
+        document = {
+            "kumaconf": {
+                "format_version": FORMAT_VERSION,
+                "tool_version": __version__,
+                "generated_at": _now(),
+                "source_database": os.path.basename(path),
+                "secrets_included": bool(include_secrets),
+            },
+            "tables": {},
+            "tables_not_found": [],
+            "omitted_secrets": [],
+            "history_tables_skipped": sorted(t for t in HISTORY_TABLES if t in present),
+        }
+        omitted = set()
+        for table in CONFIG_TABLES:
+            if table not in present:
+                document["tables_not_found"].append(table)
+                continue
+            columns = column_names(con, table)
+            if not columns:
+                raise DatabaseError("table %s has no columns" % table)
+            hidden = () if include_secrets else secret_columns(table, columns)
+            quoted = ", ".join('"%s"' % c for c in columns)
+            rows = []
+            for raw in con.execute(
+                'SELECT %s FROM "%s" ORDER BY rowid' % (quoted, table)
+            ):
+                row = list(raw)
+                for name in hidden:
+                    index = columns.index(name)
+                    if row[index] is not None:
+                        row[index] = None
+                        omitted.add("%s.%s" % (table, name))
+                if table == "setting" and not include_secrets:
+                    row = _mask_setting(columns, row, omitted)
+                rows.append(_encode_row(row))
+            document["tables"][table] = {"columns": columns, "rows": rows}
+        document["omitted_secrets"] = sorted(omitted)
+        return document
+    finally:
+        con.close()
+
+
+def _mask_setting(columns, row, omitted):
+    if "key" not in columns or "value" not in columns:
+        return row
+    key = row[columns.index("key")]
+    if is_secret_setting_key(key):
+        value_index = columns.index("value")
+        if row[value_index] is not None:
+            row[value_index] = None
+            omitted.add("setting.value (key %s)" % key)
+    return row
+
+
+def _encode_row(row):
+    """Make the row safe for JSON. Binary values are refused rather than mangled."""
+    out = []
+    for value in row:
+        if isinstance(value, (bytes, bytearray, memoryview)):
+            raise DatabaseError(
+                "a binary value was found in the configuration, which this version does not export"
+            )
+        out.append(value)
+    return out