Add FORGET env variable to run restic forget #39

New Issue

p4u1 · 2023-11-10T14:45:39Z

p4u1 commented

2023-11-10 14:45:39 +00:00

FORGET is a string which should contain a list of flags according to the official documentation

When FORGET is set restic froget $FORGET is run after startup.

`FORGET` is a string which should contain a list of flags according to [the official documentation](https://restic.readthedocs.io/en/stable/060_forget.html#removing-snapshots-according-to-a-policy) When `FORGET` is set `restic froget $FORGET` is run after startup.

moritz commented

2023-12-07 17:37:38 +00:00

What about adding restic froget $FORGET as cronjob if $FORGET is set?

I'm asking myself for a while about a smart pruning strategy without exposing delete permissions to the backupbot and risking the data. I would always recommend to setup the backup remote storage with read and append only permissions without being able to delete snapshots, for the case the backupbot or it's host system got compromised.

Therefore we need extra credentials to access the remote storage for pruning old backups, and keeping these credentials very safe. I don't really see a safe way aside manually pruning the backups in a reasonable interval.
I'm not sure if the backupbot could help us and if we at least prune all backupbot instances at once.

What about adding `restic froget $FORGET` as cronjob if `$FORGET` is set? I'm asking myself for a while about a smart pruning strategy without exposing delete permissions to the backupbot and risking the data. I would always recommend to setup the backup remote storage with read and append only permissions without being able to delete snapshots, for the case the backupbot or it's host system got compromised. Therefore we need extra credentials to access the remote storage for pruning old backups, and keeping these credentials very safe. I don't really see a safe way aside manually pruning the backups in a reasonable interval. I'm not sure if the backupbot could help us and if we at least prune all backupbot instances at once.

Sign in to join this conversation.