Encrypted backups (extras/backup.sh)

SYNOPSIS

wrenctl install backup                     set it up (asks where backups go, and the password)
wrenctl remove backup                      remove it (the backups themselves stay)
wrenctl manual backup                      print the manual steps below

backup                         back up your home folder now (then unplug the drive)
backup remind                  a word if the last backup is 30 days old (it runs at login)
backup snapshots               list your backups
backup ls latest               the files in the newest backup
backup restore latest --target ~/restored [--include ~/.electrum]
                               get everything (or one folder) back, into ~/restored
backup diff ID1 ID2            what changed between two backups
backup check                   make sure the backup isn't damaged
backup forget --keep-last 10 --prune   keep only the 10 newest

Encrypted backups of your home folder with restic, from Debian, to a folder you choose, best on a USB drive. Everything in a backup is encrypted with a password restic asks for each time, which is never written down (for unattended backups, the settings can hold a command that prints it), and each backup stores only what changed since the last. Caches, the Trash, VM disks and Wren Linux's offline downloads are left out (~/.config/wren/backup-excludes, yours to edit). The backup command (bin/backup) runs restic on your backup; restored files keep their full path, e.g. ~/restored/home/you/.electrum. At every login it says so when the last backup is 30 days old or more (a notification in sway, a line on a text console). Unplug the drive after each backup: one that stays plugged in goes with whatever deletes or encrypts your files.

LIMITS

• Without the password the backup can't be opened, and your KeePassXC database is inside it: keep the password somewhere safe outside this laptop.
• A backup on a drive that stays plugged in can be lost with the laptop; keep one away from it.
• Nothing runs by itself: you run backup.
• Anything running as you can read your files before they're backed up, and the password command's output.

MANUAL INSTALL

# restic, from Debian
sudo apt install --no-install-recommends restic

# Where backups go: a folder on a USB drive (plug it in first)
REPO=/media/$USER/NAME/wren-backup
mkdir -p "$REPO"
# A new, encrypted backup there: choose a strong password, and keep it
# somewhere safe outside this laptop (on paper, too)
restic -r "$REPO" init

# The settings the backup command reads (add a line
# PASSWORD_COMMAND=... with a command that prints the password, for backups
# that run without you)
mkdir -p ~/.config/wren
printf 'BACKUP_REPO=%s\n' "$REPO" >~/.config/wren/backup.conf
# What is left out, one pattern per line
printf '%s\n' "$HOME/.cache" "$HOME/.local/share/Trash" "$HOME/.local/share/libvirt/images" \
    "$HOME/vpskvm" "@WREN_DIR@/offline" >~/.config/wren/backup-excludes

# The backup command
install -D -m 0755 @WREN_DIR@/bin/backup ~/.local/bin/backup
backup
# Then unplug the drive. At login, a word when the last backup is 30 days old:
# in sway (~/.config/sway/config.d is read by Wren Linux's sway config)
printf '%s\n' 'exec ~/.local/bin/backup remind' >~/.config/sway/config.d/backup-reminder.conf
# and on a text console
printf '%s\n' '[ -n "${WAYLAND_DISPLAY:-}" ] || ~/.local/bin/backup remind' >>~/.bashrc

To undo (your backups themselves stay where they are):

# The command and its settings
rm ~/.local/bin/backup ~/.config/wren/backup.conf ~/.config/wren/backup-excludes ~/.config/sway/config.d/backup-reminder.conf
# and take the "backup remind" line out of ~/.bashrc
# restic
sudo apt purge restic