Add passcommand for database dumps #795

New Issue

Closed

opened 2023-11-24 20:16:08 +00:00 by Martin · 7 comments

Martin commented 2023-11-24 20:16:08 +00:00

Copy Link

What I'd like to do and why

A passcommand in addition to password for database dumps would be nice for those who cannot login without password nor like to have the password in config.yaml.

Other notes / implementation ideas

No response

### What I'd like to do and why A `passcommand` in addition to `password` for database dumps would be nice for those who cannot login without password nor like to have the password in `config.yaml`. ### Other notes / implementation ideas _No response_

witten added the

good first issue

label 2023-11-24 21:17:27 +00:00

witten commented 2023-11-24 21:21:36 +00:00

Owner

Copy Link

Thanks for taking the time to file this! Maybe there could be a new option in each database configuration that allows the user to specify the passcommand for that database instead of a password. And if specified, borgmatic would call out to that command, consuming its stdout (stripped of newlines) to get the password to use.

In the meantime though, these docs may be helpful: https://torsion.org/borgmatic/docs/how-to/provide-your-passwords/

Thanks for taking the time to file this! Maybe there could be a new option in each database configuration that allows the user to specify the passcommand for that database instead of a password. And if specified, borgmatic would call out to that command, consuming its stdout (stripped of newlines) to get the password to use. In the meantime though, these docs may be helpful: https://torsion.org/borgmatic/docs/how-to/provide-your-passwords/

IBims1NicerTobi commented 2023-11-27 12:43:11 +00:00

Contributor

Copy Link

But borgmatic can already do that right? Afaik it should support reading things from the env so why add a feature to do that manually for one field? Is there any limitation to running your password script before calling borgmatic, saving the output in the env and calling borgmatic after that?

But borgmatic can already do that right? Afaik it should support reading things from the env so why add a feature to do that manually for one field? Is there any limitation to running your password script before calling borgmatic, saving the output in the env and calling borgmatic after that?

witten commented 2023-11-27 22:22:34 +00:00

Owner

Copy Link

If there's one common theme in borgmatic feature requests, it's that users want to do more and more directly from the configuration file rather than having to rely on external shell scripting. Having said that, the work-around you describe is a totally viable option for certain users.

If there's one common theme in borgmatic feature requests, it's that users want to do more and more directly from the configuration file rather than having to rely on external shell scripting. Having said that, the work-around you describe is a totally viable option for certain users.

witten commented 2025-02-16 02:49:45 +00:00

Owner

Copy Link

@Martin borgmatic is getting several new credential loading hooks in the next release. None of them directly solve this ask, but it would be pretty easy now to add a new credential hook that allows calling arbitrary commands from password fields within borgmatic's configuration file. Made-up example:

postgresql_databases:
    - name: invoices
      username: postgres
      password: "{credential command some-command-to-run}"

However, one question first so I can understand the use case: What command do you want to run to get your password? It might be useful to support running arbitrary commands, but it might also be neat to add a more targeted credential hook as well (or instead). For instance, I just added a credential hook that allows loading credentials from KeePassXC, a password manager. Example:

postgresql_databases:
    - name: invoices
      username: postgres
      password: "{credential keepassxc keys.kdbx borgmatic}"

So where is your database password actually coming from?

@Martin borgmatic is getting several new credential loading hooks in the next release. None of them directly solve this ask, but it would be pretty easy now to add a new credential hook that allows calling arbitrary commands from password fields within borgmatic's configuration file. Made-up example: ```yaml postgresql_databases: - name: invoices username: postgres password: "{credential command some-command-to-run}" ``` However, one question first so I can understand the use case: What command do you want to run to get your password? It might be useful to support running arbitrary commands, but it might also be neat to add a more targeted credential hook as well (or instead). For instance, I just added a credential hook that allows loading credentials from KeePassXC, a password manager. Example: ```yaml postgresql_databases: - name: invoices username: postgres password: "{credential keepassxc keys.kdbx borgmatic}" ``` So where is your database password actually coming from?

Martin commented 2025-02-16 10:45:55 +00:00

Author

Copy Link

So where is your database password actually coming from?

In my case, it is probably sth. simple as cat <filename>, while the file contains only the password.
I.e. special handling that might make sense.

> So where is your database password actually coming from? In my case, it is probably sth. simple as `cat <filename>`, while the file contains only the password. I.e. special handling that might make sense.

witten commented 2025-02-16 17:15:13 +00:00

Owner

Copy Link

Oh, good news then! This is already implemented in main and will be part of the next release! Example usage:

postgresql_databases:
    - name: invoices
      username: postgres
      password: "{credential file /path/to/my/credential.txt}"

What that does is read the contents of the /path/to/my/credential.txt file and insert it into the password field.

So I'll call this done for now even though it doesn't (yet) support running arbitrary commands. But that could potentially be added later on if there's a need.

Oh, good news then! This is already implemented in main and will be part of the next release! Example usage: ``` postgresql_databases: - name: invoices username: postgres password: "{credential file /path/to/my/credential.txt}" ``` What that does is read the contents of the `/path/to/my/credential.txt` file and insert it into the password field. So I'll call this done for now even though it doesn't (yet) support running arbitrary commands. But that could potentially be added later on if there's a need.

witten closed this issue 2025-02-16 17:15:19 +00:00

witten commented 2025-02-22 22:43:38 +00:00

Owner

Copy Link

Released in borgmatic 1.9.11!

Released in borgmatic 1.9.11!

Sign in to join this conversation.

No Branch/Tag Specified

Branches Tags

main

2.0.6

2.0.5

2.0.4

2.0.3

2.0.2

2.0.1

2.0.0

1.9.14

1.9.13

1.9.12

1.9.11

1.9.10

1.9.9

1.9.8

1.9.7

1.9.6

1.9.5

1.9.4

1.9.3

1.9.2

1.9.1

1.9.0

1.8.14

1.8.13

1.8.12

1.8.11

1.8.10

1.8.9

1.8.8

1.8.7

1.8.6

1.8.5

1.8.4

1.8.3

1.8.2

1.8.1

1.8.0

1.7.15

1.7.14

1.7.13

1.7.12

1.7.11

1.7.10

1.7.9

1.7.8

1.7.7

1.7.6

1.7.5

1.7.4

1.7.3

1.7.2

1.7.1

1.7.0

1.6.6

1.6.5

1.6.4

1.6.3

1.6.2

1.6.1

1.6.0

1.5.24

1.5.23

1.5.22

1.5.21

1.5.20

1.5.19

1.5.18

1.5.17

1.5.16

1.5.15

1.5.14

1.5.13

1.5.12

1.5.11

1.5.10

1.5.9

1.5.8

1.5.7

1.5.7.dev0

1.5.6

1.5.5

1.5.4

1.5.3

1.5.2

1.5.1

1.5.0

1.4.22

1.4.21

1.4.20

1.4.19

1.4.18

1.4.17

1.4.16

1.4.15

1.4.14

1.4.13

1.4.12

1.4.11

1.4.10

1.4.9

1.4.8

1.4.7

1.4.6

1.4.5

1.4.4

1.4.3

1.4.2

1.4.1

1.4.0

1.3.26

1.3.25

1.3.24

1.3.23

1.3.22

1.3.21

1.3.20

1.3.19

1.3.18

1.3.17

1.3.16

1.3.15

1.3.14

1.3.13

1.3.12

1.3.11

1.3.10

1.3.9

1.3.8

1.3.7

1.3.6

1.3.5

1.3.4

1.3.3

1.3.2

1.3.1

1.3.0

1.2.18

1.2.17

1.2.16

1.2.15

1.2.14

1.2.13

1.2.12

1.2.11

1.2.10

1.2.9

1.2.8

1.2.7

1.2.6

1.2.5

1.2.4

1.2.3

1.2.2

1.2.1

1.2.0

1.1.15

1.1.14

1.1.13

1.1.12

1.1.11

1.1.10

1.1.9

1.1.7

1.1.6

1.1.5

1.1.4

1.1.3

1.1.2

1.1.1

1.1.0

1.0.3

1.0.2

1.0.1

1.0.0

0.1.8

0.1.7

0.1.6

0.1.5

0.1.4

0.1.3

0.1.2

0.1.1

0.1.0

0.0.7

0.0.6

0.0.5

0.0.4

0.0.3

0.0.2

Labels

Clear labels

blocked

bug

data loss

design finalized

good first issue

new feature area

question / support

security

waiting for response

No Label

good first issue

Milestone

No items

No Milestone

Assignees

Clear assignees

diivi import_bot witten

No Assignees

3 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: borgmatic-collective/borgmatic#795

No description provided.