# Encrypted backups (`extras/backup.sh`)

## SYNOPSIS

```
wrenctl install backup                     set it up (asks where backups go, and the password)
wrenctl remove backup                      remove it (the backups themselves stay)
wrenctl manual backup                      print the manual steps below

backup                         back up your home folder now (then unplug the drive)
backup remind                  a word if the last backup is 30 days old (it runs at login)
backup snapshots               list your backups
backup ls latest               the files in the newest backup
backup restore latest --target ~/restored [--include ~/.electrum]
                               get everything (or one folder) back, into ~/restored
backup diff ID1 ID2            what changed between two backups
backup check                   make sure the backup isn't damaged
backup forget --keep-last 10 --prune   keep only the 10 newest
```

Encrypted backups of your home folder with restic, from Debian, to a folder
you choose, best on a USB drive. Everything in a backup is encrypted with a
password restic asks for each time, which is never written down (for
unattended backups, the settings can hold a command that prints it), and each
backup stores only what changed since the last. Caches, the Trash, VM disks
and Wren Linux's offline downloads are left out (`~/.config/wren/backup-excludes`,
yours to edit). The `backup` command (`bin/backup`) runs restic on your
backup; restored files keep their full path, e.g. `~/restored/home/you/.electrum`.
At every login it says so when the last backup is 30 days old or more (a
notification in sway, a line on a text console). Unplug the drive after each
backup: one that stays plugged in goes with whatever deletes or encrypts your
files.

## LIMITS

- Without the password the backup can't be opened, and your KeePassXC database is inside it: keep the password somewhere safe outside this laptop.
- A backup on a drive that stays plugged in can be lost with the laptop; keep one away from it.
- Nothing runs by itself: you run `backup`.
- Anything running as you can read your files before they're backed up, and the password command's output.

## MANUAL INSTALL

```
# restic, from Debian
sudo apt install --no-install-recommends restic

# Where backups go: a folder on a USB drive (plug it in first)
REPO=/media/$USER/NAME/wren-backup
mkdir -p "$REPO"
# A new, encrypted backup there: choose a strong password, and keep it
# somewhere safe outside this laptop (on paper, too)
restic -r "$REPO" init

# The settings the backup command reads (add a line
# PASSWORD_COMMAND=... with a command that prints the password, for backups
# that run without you)
mkdir -p ~/.config/wren
printf 'BACKUP_REPO=%s\n' "$REPO" >~/.config/wren/backup.conf
# What is left out, one pattern per line
printf '%s\n' "$HOME/.cache" "$HOME/.local/share/Trash" "$HOME/.local/share/libvirt/images" \
    "$HOME/vpskvm" "@WREN_DIR@/offline" >~/.config/wren/backup-excludes

# The backup command
install -D -m 0755 @WREN_DIR@/bin/backup ~/.local/bin/backup
backup
# Then unplug the drive. At login, a word when the last backup is 30 days old:
# in sway (~/.config/sway/config.d is read by Wren Linux's sway config)
printf '%s\n' 'exec ~/.local/bin/backup remind' >~/.config/sway/config.d/backup-reminder.conf
# and on a text console
printf '%s\n' '[ -n "${WAYLAND_DISPLAY:-}" ] || ~/.local/bin/backup remind' >>~/.bashrc
```

To undo (your backups themselves stay where they are):

```
# The command and its settings
rm ~/.local/bin/backup ~/.config/wren/backup.conf ~/.config/wren/backup-excludes ~/.config/sway/config.d/backup-reminder.conf
# and take the "backup remind" line out of ~/.bashrc
# restic
sudo apt purge restic
```