borgmatic-collective/borgmatic
borgmatic-collective/borgmatic
12
65
Fork 17
Code Issues 48 Pull Requests 3 Actions Packages Releases 135 Activity

borgpw -> borgmatic.pw

Browse Source
This commit is contained in:
cvlc12 2024-10-13 15:37:48 +02:00
parent 3779c7f09b
commit 12879bda2e
2 changed files with 13 additions and 13 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

22
docs/how-to/provide-your-passwords.md
View File

@ -33,31 +33,31 @@ encryption_passcommand: pass path/to/borg-repokey
Borgmatic supports using encrypted [credentials](https://systemd.io/CREDENTIALS/).
Save your password as an encrypted credential to `/etc/credstore.encrypted/borgpw`, e.g.,
Save your password as an encrypted credential to `/etc/credstore.encrypted/borgmatic.pw`, e.g.,
```
# systemd-ask-password -n | systemd-creds encrypt - /etc/credstore.encrypted/borgpw
# systemd-ask-password -n | systemd-creds encrypt - /etc/credstore.encrypted/borgmatic.pw
```
Note that the name `borgpw` is hardcoded in the systemd service file.
Note that the name `borgmatic.pw` is hardcoded in the systemd service file.
If you use multiple different passwords, save them as encrypted credentials to `/etc/credstore.encrypted/borg/`, e.g.,
If you use multiple different passwords, save them as encrypted credentials to `/etc/credstore.encrypted/borgmatic/`, e.g.,
```
# mkdir /etc/credstore.encrypted/borg
# systemd-ask-password -n | systemd-creds encrypt --name=borg_backupserver1 - /etc/credstore.encrypted/borg/backupserver1
# systemd-ask-password -n | systemd-creds encrypt --name=borg_pw2 - /etc/credstore.encrypted/borg/pw2
# mkdir /etc/credstore.encrypted/borgmatic
# systemd-ask-password -n | systemd-creds encrypt --name=borgmatic_backupserver1 - /etc/credstore.encrypted/borgmatic/backupserver1
# systemd-ask-password -n | systemd-creds encrypt --name=borgmatic_pw2 - /etc/credstore.encrypted/borgmatic/pw2
...
```
Ensure that the file names, (e.g. `backupserver1`) match the corresponding part of
the `--name` option *after* the underscore (_). The `borg` folder is hardcoded in the systemd service file.
the `--name` option *after* the underscore (_). The `borgmatic` folder is hardcoded in the systemd service file.
Then uncomment or use one of the following in your configuration file. Adjust `borg_backupserver1`
Then uncomment or use one of the following in your configuration file. Adjust `borgmatic_backupserver1`
according to the name given to the credential.
```yaml
encryption_passcommand: "cat ${CREDENTIALS_DIRECTORY}/borgpw"
encryption_passcommand: "cat ${CREDENTIALS_DIRECTORY}/borg_backupserver1"
encryption_passcommand: "cat ${CREDENTIALS_DIRECTORY}/borgmatic.pw"
encryption_passcommand: "cat ${CREDENTIALS_DIRECTORY}/borgmatic_backupserver1"
```
### Environment variable interpolation

4
sample/systemd/borgmatic.service
View File

@ -10,8 +10,8 @@ ConditionACPower=true
Type=oneshot
# Load encrypted credentials.
LoadCredentialEncrypted=borg:/etc/credstore.encrypted/borg/
LoadCredentialEncrypted=borgpw
LoadCredentialEncrypted=borgmatic:/etc/credstore.encrypted/borgmatic/
LoadCredentialEncrypted=borgmatic.pw
# Security settings for systemd running as root, optional but recommended to improve security. You
# can disable individual settings if they cause problems for your use case. For more details, see