Add FORGET env variable to run restic forget #39

New Issue

2023-11-10T14:45:39Z

p4u1 commented

2023-11-10 14:45:39 +00:00

FORGET is a string which should contain a list of flags according to the official documentation

When FORGET is set restic froget $FORGET is run after startup.

`FORGET` is a string which should contain a list of flags according to [the official documentation](https://restic.readthedocs.io/en/stable/060_forget.html#removing-snapshots-according-to-a-policy) When `FORGET` is set `restic froget $FORGET` is run after startup.

👍 1

moritz commented

2023-12-07 17:37:38 +00:00

What about adding restic froget $FORGET as cronjob if $FORGET is set?

I'm asking myself for a while about a smart pruning strategy without exposing delete permissions to the backupbot and risking the data. I would always recommend to setup the backup remote storage with read and append only permissions without being able to delete snapshots, for the case the backupbot or it's host system got compromised.

Therefore we need extra credentials to access the remote storage for pruning old backups, and keeping these credentials very safe. I don't really see a safe way aside manually pruning the backups in a reasonable interval.
I'm not sure if the backupbot could help us and if we at least prune all backupbot instances at once.

What about adding `restic froget $FORGET` as cronjob if `$FORGET` is set? I'm asking myself for a while about a smart pruning strategy without exposing delete permissions to the backupbot and risking the data. I would always recommend to setup the backup remote storage with read and append only permissions without being able to delete snapshots, for the case the backupbot or it's host system got compromised. Therefore we need extra credentials to access the remote storage for pruning old backups, and keeping these credentials very safe. I don't really see a safe way aside manually pruning the backups in a reasonable interval. I'm not sure if the backupbot could help us and if we at least prune all backupbot instances at once.

dwaxweiler commented

2025-02-06 09:48:55 +00:00

Such a feature would be really useful, especially if you have limited backup storage capacities.

@moritz, you are mentioning manual pruning. How do you do it?

Such a feature would be really useful, especially if you have limited backup storage capacities. @moritz, you are mentioning manual pruning. How do you do it?

moritz commented

2025-10-20 11:51:51 +00:00

We are considering using S3 Object Locks: https://forum.restic.net/t/ransomware-protection/7098/5
This way it would be possible to purge old backups regularly, and if backups were deleted by accident or ransonware you have still a specified time left to recover the deleted files.

We are considering using S3 Object Locks: https://forum.restic.net/t/ransomware-protection/7098/5 This way it would be possible to purge old backups regularly, and if backups were deleted by accident or ransonware you have still a specified time left to recover the deleted files.

👍 1 👀 1

Sign in to join this conversation.

3 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coop-cloud/backup-bot-two#39

Add FORGET env variable to run restic forget #39

Add `FORGET` env variable to run `restic forget` #39