From cb750d4cb4795008d964a9a7115bb3e3b9d3d615 Mon Sep 17 00:00:00 2001 From: Matt Conley Date: Thu, 20 Mar 2025 22:17:40 -0400 Subject: [PATCH 1/2] Add UNENCRYPTED environemnt variable --- docker-compose/.env.example | 3 +++ docker/src/s6-services/key_setup/run | 6 ++++++ 2 files changed, 9 insertions(+) diff --git a/docker-compose/.env.example b/docker-compose/.env.example index 6ed4e38..9c300d7 100644 --- a/docker-compose/.env.example +++ b/docker-compose/.env.example @@ -6,6 +6,9 @@ CRON_SCHEDULE="0 */4 * * *" # If you want to skip backup on startup, set CRON_BACKUP_ONLY=1 otherwise CRON_BACKUP_ONLY=0 CRON_BACKUP_ONLY=0 +# Set UNENCRYPTED=1 to bypass key generation and allow the backup to be unencrypted +UNENCRYPTED=0 + # Use of the PBS_API_KEY_NAME and PBS_API_KEY_SECRET is recommended! # If unset, ensure PBS_USER and PBS_PASSWORD are set. PBS_API_KEY_NAME="username@pam!test" diff --git a/docker/src/s6-services/key_setup/run b/docker/src/s6-services/key_setup/run index 13e6c76..92f0227 100755 --- a/docker/src/s6-services/key_setup/run +++ b/docker/src/s6-services/key_setup/run @@ -20,6 +20,12 @@ handle_error() { } trap handle_error ERR +# Check if encryption is disabled via environment variable +if [ "${UNENCRYPTED}" = "1" ]; then + echo "Encrypted backups are disabled. Skipping key setup process." + exit 0 +fi + client_encryption_keyfile="/root/.config/proxmox-backup/encryption-key.json" master_private_keyfile="/root/.config/proxmox-backup/master-private.pem" master_public_keyfile="/root/.config/proxmox-backup/master-public.pem" From 92f23512e1081ca3cc9bbeabed2bd91d745e491b Mon Sep 17 00:00:00 2001 From: Aterfax Date: Sun, 23 Mar 2025 19:47:18 +0000 Subject: [PATCH 2/2] Add some clear warnings and discourage the use of unencrypted backups. --- README.md | 8 ++++++++ docker-compose/.env.example | 4 +++- docker/src/s6-services/key_setup/run | 2 ++ 3 files changed, 13 insertions(+), 1 deletion(-) diff --git a/README.md b/README.md index f8751f8..40e04fa 100644 --- a/README.md +++ b/README.md @@ -40,6 +40,9 @@ For more in depth instructions, see: [Using-the-DockerHub-provided-image](#Using ### Using the DockerHub provided image +> [!WARNING] +> It is possible, but highly discouraged for you to make unencrypted backups by setting `UNENCRYPTED=1` in your ``.env`` file. This will bypass the automatic key generation process but **this is a bad idea** as the backed-up data will be stored in plaintext. This means that the owner of the PBS backup server you are backing up to will have full access to explore the backed-up content. + * Run the image with the provided docker-compose file after amending it and the ``.env`` file where needed. * If allowing the container to conduct an auto setup, don't set a ``PBS_ENCRYPTION_PASSWORD`` value yet as the container first run will autogenerate one for you. * Supply your desired ``master-public.pem``, ``master-private.pem`` and ``encryption-key.json`` files with a matching ``PBS_ENCRYPTION_PASSWORD`` or allow the container to automatically generate these for you on first run. @@ -97,6 +100,11 @@ See also: - https://github.com/Aterfax/pbs-client-docker/issues/8 - https://forum.proxmox.com/threads/backup-client-encryption-not-working-inside-docker-container.139054/ +> [!WARNING] +> It is possible, but highly discouraged for you to bypass this issue by taking unencrypted backups. You can do this by setting `UNENCRYPTED=1` in your ``.env`` file and this will bypass the automatic key generation process. +> +>**This is a bad idea** as the backed-up data will be stored in plaintext. This means that the owner of the PBS backup server you are backing up to will have full access to explore the backed-up content. + ## Troubleshooting If you encounter issues, check the [Troubleshooting section](TROUBLESHOOTING.md) for solutions to common problems. diff --git a/docker-compose/.env.example b/docker-compose/.env.example index 9c300d7..710ede4 100644 --- a/docker-compose/.env.example +++ b/docker-compose/.env.example @@ -6,7 +6,9 @@ CRON_SCHEDULE="0 */4 * * *" # If you want to skip backup on startup, set CRON_BACKUP_ONLY=1 otherwise CRON_BACKUP_ONLY=0 CRON_BACKUP_ONLY=0 -# Set UNENCRYPTED=1 to bypass key generation and allow the backup to be unencrypted +# Set UNENCRYPTED=1 to bypass automatic encryption key generation and allow the backups to be unencrypted. +# This is a bad idea as the owner of the PBS backup server you are backing up to will have full access to +# explore the backed-up content. UNENCRYPTED=0 # Use of the PBS_API_KEY_NAME and PBS_API_KEY_SECRET is recommended! diff --git a/docker/src/s6-services/key_setup/run b/docker/src/s6-services/key_setup/run index 92f0227..8845030 100755 --- a/docker/src/s6-services/key_setup/run +++ b/docker/src/s6-services/key_setup/run @@ -23,6 +23,8 @@ trap handle_error ERR # Check if encryption is disabled via environment variable if [ "${UNENCRYPTED}" = "1" ]; then echo "Encrypted backups are disabled. Skipping key setup process." + echo "" + echo "This is a bad idea as the owner of the PBS backup server you are backing up to will have full access to explore the backed-up content." exit 0 fi