cross-posted from: https://lemmy.ml/post/54692477
i’m setting up plakar as a backup tool and i wanted to use some systemd service and timer files to trigger the backups automatically. the issue is that doing so requires the plakar passhprase. what is the best way to handle this? because the best options seem to require interactivity and i need a non interactive solution. is the standard solution to simply let the passphrase as a plaintext or what?
i used to use an ansible playbook and a vault file to protect passwords – it’s more involved to setup buy pretty rock solid.
I had to google what plakar even is, but they seem to think that’s the standard solution as you can give the plaintext passphrase as a variable at startup. Waht’s speaking against a passphrase as plaintext, set to be readable by root only?
it’s a new tool, it’s similar to restic which is a bit older i think. i just think it’s a bit odd, keeping a secret in plain text. would using something like tpm to store the credential be a bit overkill? i’m not an expert so i don’t fully understand how it works but i think this way i could backup non-interactively and the key would only be in plaintext for some time in tmpfs while plakar does the back up. or is this dumb?
I just pass env files to containers, don’t know if I could be doing it anything more robust or safe. I did encrypt the partition though.
Which is what Plakar suggests, too, as their cli tool reads the PLAKAR_PASSPHRASE environmental variable.
yeah, i do the same and it’s a very similar situation now that you mention it. although you could say that maybe some containers don’t hold information that’s very critical or something sometimes. also since you could backup the container with plakar it could be considered a higher security concern i guess? i also have my partition encrypted.
Took me 20 seconds to find without having ever heard about it before https://www.plakar.io/docs/community/v1.1.0/guides/setup-scheduler-daily-backups/#make-the-passphrase-available-without-a-prompt
that lists some options. i have already read that file. i wanted to know if there is some better way to do this without leaving the key as plain text. so thanks i guess…
If you have it encrypted or somehow encoded, you would still need a keyfile or keyword to decrypt/decode. So it’s either interactive input, or a read-only (just by the owner) keyfile/password as env variable.
