Running borg init via a borg serve --append-only server will not create an append-only repository.

[sunknudsen]

Have you checked borgbackup docs, FAQ, and open Github issues?

Yes

Is this a BUG / ISSUE report or a QUESTION?

QUESTION

Describe the problem you're observing.

What exactly does the following mean?

Running borg init via a borg serve --append-only server will not create an append-only repository.

My understanding is that if the server is configured using the following authorized_keys, when initializing a repo using borg init --encryption=keyfile-blake2 "borg@server:backup", --append-only on the server is ignored.

command="borg serve --append-only --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa ...

This doesn't feel logical to me as the server config should supersede client (for security reasons). Also, I would like to use two SSH keys, one with --append-only and one without (using a key that requires a YubiKey for increased security).

command="borg serve --append-only --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa ...

vs

command="borg serve --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa ...

Can someone please confirm how this works?

[sunknudsen]

In other words, I don't understand the use cases of --append-only when used in authorized_keys.

Do we have to run borg config "backup" append_only 0 and borg config "backup" append_only 1 on the sever to switch append only mode or can we use the --append-only flag in authorized_keys once repo has been initialized using borg init --encryption=keyfile-blake2 "borg@server:backup"?

[sunknudsen]

Also, what about --storage-quota?

[sunknudsen]

According to my experiments, initializing a repo using borg init --encryption=keyfile-blake2 "borg@server:backup" on a server with the following authorized_keys will be initialized as append-only (running borg delete "borg@server:backup" returns ValueError: /home/borg/backup is in append-only mode unless admin key is used).

command="borg serve --append-only --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa ... borg
command="borg serve --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa ... admin

If the above is true, the following statement in the docs is misleading or incorrect.

Running borg init via a borg serve --append-only server will not create an append-only repository.

Once consensus is reached, I will submit a PR to improve the docs.

[ThomasWaldmann]

Check what's in the repo/config file after that, guess there is no append_only = 1 and that is intended.

That way, you can have "append-only" for one ssh key and "not append-only" for another, e.g. if you want to run prune from a trusted client machine.

[sunknudsen]

Thanks for the follow-up @ThomasWaldmann.

I am putting together a Borg episode for the privacy guides (see https://www.youtube.com/sunknudsen).

I take fact checking very seriously and I am having a hard time figuring out the docs. My experiments point to conflicting results.

I would love to pick your brain over a call to make sure I understand Borg correctly. Once I do, I would be happy to submit a Pr to improve the docs.

If you are down, please get in touch via https://sunknudsen.com/.

[sunknudsen]

Check what's in the repo/config file after that, guess there is no append_only = 1 and that is intended.

append_only = 0

[ThomasWaldmann]

Yup, and that is what is meant in the docs.

[sunknudsen]

@ThomasWaldmann But using command="borg serve --append-only --restrict-to-repository /home/borg/backup --storage-quota 10G",restrict ssh-rsa ... does enable append only mode right, even if append_only = 0 is set in the repo/config?

If so, the following statement is misleading for the above use case.

Running borg init via a borg serve --append-only server will not create an append-only repository.

[sunknudsen]

@ThomasWaldmann Perhaps that line should be changed to something like the following.

Running borg init via a borg serve --append-only server will not create an append-only repository but --append-only arguments in authorized_keys will override repository config therefore append-only mode can be enabled on a key by key basis.

[ThomasWaldmann]

How about:

Running borg init via a borg serve --append-only server will not create a repository that is configured to be append-only by its repository config.

But, --append-only arguments in authorized_keys will override the repository config, therefore append-only mode can be enabled on a key by key basis.

[ThomasWaldmann]

Q: Do we have to run borg config "backup" append_only 0 and borg config "backup" append_only 1 on the sever to switch append only mode

A: You could do that, but using different ssh keys and different entries in authorized_keys is much easier and also maybe has less potential of thing going wrong somehow.

[sunknudsen]

How about:

Running borg init via a borg serve --append-only server will not create a repository that is configured to be append-only by its repository config.

But, --append-only arguments in authorized_keys will override the repository config, therefore append-only mode can be enabled on a key by key basis.

@ThomasWaldmann I like it! This makes using --append-only so much more predictable.

Btw, thanks for Borg! Impressed by how thorough the project is.

[ThomasWaldmann]

Thanks, you're welcome!

Do you want to make a PR against master branch?

[sunknudsen]

Yes, on it!

[sunknudsen]

Just forked the repo and noticed the docs are generated using a framework I don't know so I would likely submit a shitty PR.

Best if you take care of updating the docs. I will focus on the video... that I can manage.

Btw, I developed a very lightweight Swift macOS app that runs Borg in the background complying with Apple permissions so Borg can access restricted file paths (such as ~/Documents) and can be scheduled using a launchd LaunchAgent.

The app also displays notifications when backups start, complete or fail and, when clicked, a log file is displayed using the "Console" app.

$ cat ~/Library/LaunchAgents/local.borg-backup.plist
<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
  <dict>
    <key>Label</key>
    <string>Borg Backup.app</string>

    <key>ProgramArguments</key>
    <array>
      <string>open</string>
      <string>/Applications/Borg Backup.app</string>
    </array>

    <key>RunAtLoad</key>
    <false/>

    <key>StartCalendarInterval</key>
    <dict>
      <key>Minute</key>
      <integer>0</integer>
    </dict>
  </dict>
</plist>

I would like to call the app "Borg Backup" and use the Borg logo (as the app is essentially a wrapper for Borg).

The Borg project would be credited and the app would be open sourced.

Are you comfortable with the above?

Thanks again for your help!

[sunknudsen]

Forgot to mention the Borg python code would not be distributed with the app... it's really just a wrapper that runs commands in the background.

showNotification("Backup initiated...")
          
// Run borg-backup.sh and log output
let command = "set -o pipefail; PATH=\"$PATH:/usr/local/bin\" borg-backup.sh 2>&1 | tee -a \(logFile)"

shell(command) {(status: Int32, output: String?) in
  if (status == 0) {
    showNotification("Backup completed")
    
    // Truncate log file to last 1000 lines
    shell("echo \"$(tail -n 1000 \(logFile))\" > \(logFile)") {(status: Int32, output: String?) in
      terminate()
    }
  } else {
    showNotification("Backup failed")
    terminate()
  }
}

[Gu1nness]

Okay I can take this one then? @sunknudsen

[sunknudsen]

Yes @Gu1nness, thanks!