SPMT/scripts/borg_daily

borg_daily

This is a script to do borg backups on the SPMT backup server. Old backups are thinned out (pruned) progressively.

Either manually run the script (more or less) daily or automatically through crontab or similar etc.

Borg backup needs the passphrase / key of your repository. In the script, there is two options to provide it:

1. set variable BORG_PASSPHRASE verbatim
2. provide a command in BORG_PASSCOMMAND to generate / load the passphrase programmatically

I prefer the second option. However, providing the passphrase programmatically safely is non-trivial, see here.

I have chosen to do this quite simple: select a password and store an obfuscated version of it in $HOME/.borg_passphrase. The provided command just undoes the obfuscation. So, before using the backup script do the following on your command line

echo "MY SUPER SECRET PASSWORD ... ACTUALLY NOT SO SECRET AS IT END UP IN YOUR HISTORY" | \
   base64 > $HOME/.borg_passphrase

Note, that it is also possible to store the password in your GNOME/macOS Keyring, or other password managers, or even on your USB crypto token. See the link above.