Encryption

Encryption is optional, symmetric, and configured per job. snapr applies it after compression. Currently only OpenSSL is supported.

Prerequisites

openssl must be installed on the snapr host and available in PATH. snapr shells out to it for encryption.
snapr runs openssl enc -<cipher> -salt -pbkdf2 -pass env:.... It forwards the password through an environment variable, never on the command line.

Fields

Option	Type	Required	Default	Description
`type`	enum	No	`openssl`	Only `openssl` is supported.
`cipher`	string	No	`aes-256-cbc`	Any cipher accepted by `openssl enc -<cipher>` (for example `aes-256-gcm`, `chacha20`).
`password`	string	Yes	—	Encryption passphrase. Use `env:` for secrets.

Example

snapr.yaml

jobs:
  - name: postgres-nightly
    # ...
    encryption:
      type: openssl
      cipher: aes-256-cbc
      password: env:BACKUP_ENC_PASSWORD

snapr appends .enc to the compressed filename (for example backup.tar.gz.enc). After a successful run, it deletes the plaintext archive from the working directory.

Lose the passphrase, lose the backup. Store it outside snapr — in a password manager or a separate secrets store.

Decrypt an archive by hand

snapr encrypts with -salt -pbkdf2, so your decrypt command must include -pbkdf2 as well.

Get the encrypted file

Download the archive from the web UI, the download API, or copy it straight off the storage backend. If the job also uses the splitter, reassemble the parts first.

Export the passphrase

Put the passphrase in an environment variable so it never appears in your shell history as a command argument:

export BACKUP_ENC_PASSWORD='your-passphrase'

Decrypt

Use the same cipher the job was configured with. With the default aes-256-cbc:

openssl enc -d -aes-256-cbc -pbkdf2 \
  -in backup.tar.gz.enc \
  -out backup.tar.gz \
  -pass env:BACKUP_ENC_PASSWORD

If you set a non-default cipher in the job config, pass that same value here.

Extract

tar -xzf backup.tar.gz

Forgetting -pbkdf2 on decrypt produces a “bad decrypt” error even with the correct passphrase, because OpenSSL then derives the key with a different function than snapr used.

Getting started

Configuration

Prerequisites

Fields

Example

Decrypt an archive by hand

​Prerequisites

​Fields

​Example

​Decrypt an archive by hand

Prerequisites

Fields

Example

Decrypt an archive by hand