feat: add restic-exporter as metrics endpoint #84

I haven't tested it yet but it looks fine. At least it won't affect the normal setup. But I would favor a clear warning that this setup opens a very dangerous attack vector. Per default the backup bot is not exposed in any way. The only attack vector would be to exploit the file parsing of restic.
The restic exporter is exposing port 8001. So if this tools has any security issues the whole system including all other apps could be compromised. And if the backup backend is not configured to be append only, even the backups could be deleted. For backup monitoring I would recommend the PUSH API with uptime kuma, as this doesn't expose any ports.

I haven't tested it yet but it looks fine. At least it won't affect the normal setup. But I would favor a clear warning that this setup opens a very dangerous attack vector. Per default the backup bot is not exposed in any way. The only attack vector would be to exploit the file parsing of restic. The restic exporter is exposing port 8001. So if this tools has any security issues the whole system including all other apps could be compromised. And if the backup backend is not configured to be append only, even the backups could be deleted. For backup monitoring I would recommend the PUSH API with uptime kuma, as this doesn't expose any ports.

stevensting commented

2026-03-31 13:20:27 +00:00

I haven't tested it yet but it looks fine. At least it won't affect the normal setup. But I would favor a clear warning that this setup opens a very dangerous attack vector. Per default the backup bot is not exposed in any way. The only attack vector would be to exploit the file parsing of restic.
The restic exporter is exposing port 8001. So if this tools has any security issues the whole system including all other apps could be compromised. And if the backup backend is not configured to be append only, even the backups could be deleted. For backup monitoring I would recommend the PUSH API with uptime kuma, as this doesn't expose any ports.

Thank you for the hint. We now also switched to Uptime kuma with push monitoring.
Not sure what to do with this PR though. Maybe just leave it open if someone else some day wants to use it?

> I haven't tested it yet but it looks fine. At least it won't affect the normal setup. But I would favor a clear warning that this setup opens a very dangerous attack vector. Per default the backup bot is not exposed in any way. The only attack vector would be to exploit the file parsing of restic. > The restic exporter is exposing port 8001. So if this tools has any security issues the whole system including all other apps could be compromised. And if the backup backend is not configured to be append only, even the backups could be deleted. For backup monitoring I would recommend the PUSH API with uptime kuma, as this doesn't expose any ports. Thank you for the hint. We now also switched to Uptime kuma with push monitoring. Not sure what to do with this PR though. Maybe just leave it open if someone else some day wants to use it?

👍 1

All checks were successful

continuous-integration/drone/push Build is passing

Details

continuous-integration/drone/pr Build is passing

Details

You are not authorized to merge this pull request.

This pull request can be merged automatically.

This branch is out-of-date with the base branch

View command line instructions

Checkout

From your project repository, check out a new branch and test the changes.

git fetch -u origin restic-exporter:restic-exporter

git checkout restic-exporter

Sign in to join this conversation.

2 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: coop-cloud/backup-bot-two#84