From 6239fe5ca6784a625c553b5b7fb4ee61a54ac0e3d60ec33cd40da6e36b48ffa4 Mon Sep 17 00:00:00 2001
From: Thomas Oettli <spacefreak@noop.ch>
Date: Thu, 27 Aug 2026 23:14:18 +0200
Subject: [PATCH] add support for encryption keys

---
 config.example |  1 +
 pbc            | 24 ++++++++++++++++++------
 2 files changed, 19 insertions(+), 6 deletions(-)

diff --git a/config.example b/config.example
index 6f22d28..8539b65 100644
--- a/config.example
+++ b/config.example
@@ -3,5 +3,6 @@ PBS_USER='backup@pam:token-name'
 PBS_PASSWORD='XXXXXXXX-XXXX-XXXX-XXXX-XXXXXXXXXXXX'
 PBS_DATASTORE='backup'
 PBS_NAMESPACE='MyBackups'
+#ENCRYPTION_KEYFILE='/etc/pbc/backup.key'
 
 BACKUP=('root.pxar:/' 'data.pxar:/mnt/data')
diff --git a/pbc b/pbc
index 4f0bf99..08c43a6 100755
--- a/pbc
+++ b/pbc
@@ -53,17 +53,17 @@ function pbc-version() {
   return $rc
 }
 
-function pbc-backup() { "$PBC" backup --ns "$PBS_NAMESPACE" "${BACKUP[@]}" "$@"; }
+function pbc-backup() { "$PBC" backup "${PBC_ARGS[@]}" "${KEY_ARGS[@]}" "${BACKUP[@]}" "$@"; }
 
-function pbc-list() { "$PBC" list --ns "$PBS_NAMESPACE" "$@"; }
+function pbc-list() { "$PBC" list "${PBC_ARGS[@]}" "$@"; }
 
-function pbc-snapshot-list() { "$PBC" snapshot list --ns "$PBS_NAMESPACE" "$@"; }
+function pbc-snapshot-list() { "$PBC" snapshot list "${PBC_ARGS[@]}" "$@"; }
 
-function pbc-files() { "$PBC" files --ns "$PBS_NAMESPACE" "$@"; }
+function pbc-files() { "$PBC" files "${PBC_ARGS[@]}" "$@"; }
 
-function pbc-catalog-shell() { "$PBC" catalog shell --ns "$PBS_NAMESPACE" "$@"; }
+function pbc-catalog-shell() { "$PBC" catalog shell "${PBC_ARGS[@]}" "${KEY_ARGS[@]}" "$@"; }
 
-function pbc-mount() { "$PBC" mount --ns "$PBS_NAMESPACE" "$@"; }
+function pbc-mount() { "$PBC" mount "${PBC_ARGS[@]}" "${KEY_ARGS[@]}" "$@"; }
 
 function get_group_names() {
   pbc-list --output-format json | jq -r '.[] | "\(.["backup-type"])/\(.["backup-id"])"'
@@ -307,8 +307,20 @@ else
   [ ! -f "$PBC" ] && echo "Error: $PBC: no such file" >&2 && exit 200
   [ ! -x "$PBC" ] && echo "Error: $PBC: not executable" >&2 && exit 200
   ! command -v jq >/dev/null && echo "Error: jq executable not found!" >&2 && exit 200
+  if [ -n "$ENCRYPTION_KEYFILE" ]; then
+    [ ! -f "$ENCRYPTION_KEYFILE" ] && echo "Error: $ENCRYPTION_KEYFILE: no such file" >&2 && exit 203
+    [ ! -r "$ENCRYPTION_KEYFILE" ] && echo "Error: $ENCRYPTION_KEYFILE: not readable" >&2 && exit 203
+    perms=$(stat -c '%a' "$ENCRYPTION_KEYFILE")
+    (( 8#$perms & 0007 )) && echo "Warning: $ENCRYPTION_KEYFILE is readable by others!" >&2
+  fi
 fi
 
+PBC_ARGS=()
+KEY_ARGS=()
+
+[ -n "$PBS_NAMESPACE" ] && PBC_ARGS+=('--ns' "$PBS_NAMESPACE")
+[ -n "$ENCRYPTION_KEYFILE" ] && KEY_ARGS+=('--keyfile' "$ENCRYPTION_KEYFILE")
+
 export PBS_REPOSITORY="$PBS_USER@$PBS_SERVER:$PBS_DATASTORE"
 export PBS_PASSWORD="$PBS_PASSWORD"