Load encrypted systemd credentials

This commit is contained in:
cvlc12 2024-10-04 12:25:20 +02:00
parent 6fdce2a4a6
commit fd91eebeda
3 changed files with 40 additions and 1 deletions

View File

@ -231,8 +231,12 @@ properties:
key. Only use on repositories that were initialized with
passcommand/repokey/keyfile encryption. Note that if both
encryption_passcommand and encryption_passphrase are set, then
encryption_passphrase takes precedence. Defaults to not set.
encryption_passphrase takes precedence. This can also be used to
access encrypted systemd service credentials (stored as
"/etc/credstore.encrypted/borgpw", or as files in
"/etc/credstore.encrypted/borg/"). Defaults to not set.
example: "secret-tool lookup borg-repository repo-name"
example: "cat ${CREDENTIALS_DIRECTORY}/borgpw"
encryption_passphrase:
type: string
description: |

View File

@ -29,6 +29,37 @@ For example, to ask the *Pass* password manager to provide the passphrase:
encryption_passcommand: pass path/to/borg-repokey
```
### Using systemd service credentials
Borgmatic supports using encrypted [credentials](https://systemd.io/CREDENTIALS/).
Save your password as an encrypted credential to `/etc/credstore.encrypted/borgpw`, e.g.,
```
# systemd-ask-password -n | systemd-creds encrypt - /etc/credstore.encrypted/borgpw
```
Note that the name `borgpw` is hardcoded in the systemd service file.
If you use multiple different passwords, save them as encrypted credentials to `/etc/credstore.encrypted/borg/`, e.g.,
```
# mkdir /etc/credstore.encrypted/borg
# systemd-ask-password -n | systemd-creds encrypt --name=borg_backupserver1 - /etc/credstore.encrypted/borg/backupserver1
# systemd-ask-password -n | systemd-creds encrypt --name=borg_pw2 - /etc/credstore.encrypted/borg/pw2
...
```
Ensure that the file names, (e.g. `backupserver1`) match the corresponding part of
the `--name` option *after* the underscore (_). The `borg` folder is hardcoded in the systemd service file.
Then uncomment or use one of the following in your configuration file. Adjust `borg_backupserver1`
according to the name given to the credential.
```yaml
encryption_passcommand: "cat ${CREDENTIALS_DIRECTORY}/borgpw"
encryption_passcommand: "cat ${CREDENTIALS_DIRECTORY}/borg_backupserver1"
```
### Environment variable interpolation
<span class="minilink minilink-addedin">New in version 1.6.4</span> borgmatic

View File

@ -9,6 +9,10 @@ ConditionACPower=true
[Service]
Type=oneshot
# Load encrypted credentials.
LoadCredentialEncrypted=borg:/etc/credstore.encrypted/borg/
LoadCredentialEncrypted=borgpw
# Security settings for systemd running as root, optional but recommended to improve security. You
# can disable individual settings if they cause problems for your use case. For more details, see
# the systemd manual: https://www.freedesktop.org/software/systemd/man/systemd.exec.html