Skip to content

Commit 1777728

Browse files
kernckernc
committed
deploy: aa798a4 
1 parent cf2b5be commit 1777728

File tree

3 files changed

+196
-0
lines changed

3 files changed

+196
-0
lines changed

‎.nojekyll

Whitespace-only changes.

‎icon.svg

Lines changed: 4 additions & 0 deletions
Loading

‎index.html

Lines changed: 192 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,192 @@
1+
<!doctype html>
2+
<html lang=en itemscope itemtype="https://schema.org/SoftwareApplication">
3+
<head>
4+
<meta charset="utf-8">
5+
<meta name="viewport" content="width=device-width, initial-scale=1.0">
6+
<title>Myba - git-based file backup with encryption</title>
7+
<link rel="logo icon" href="icon.svg">
8+
<meta name="theme-color" content="#333">
9+
<meta itemprop="applicationCategory" content="BusinessApplication"><meta itemprop="applicationCategory" content="DeveloperApplication"><meta itemprop="applicationCategory" content="SecurityApplication"><meta itemprop="applicationCategory" content="UtilitiesApplication">
10+
<meta itemprop="operatingSystem" content="Linux"><meta itemprop="operatingSystem" content="macOS"><meta itemprop="operatingSystem" content="Windows">
11+
<meta itemprop="isAccessibleForFree" content="true">
12+
<meta itemprop="license" content="https://www.gnu.org/licenses/agpl-3.0.txt">
13+
<meta itemprop="sameAs" content="https://github.com/kernc/myba/">
14+
<meta itemprop="url" content="/">
15+
<script async src="https://www.googletagmanager.com/gtag/js?id=G-JT9W3RXCJD"></script>
16+
<script>window.dataLayer=window.dataLayer||[];function gtag(){dataLayer.push(arguments);}gtag("js",new Date());gtag("config","G-JT9W3RXCJD");</script>
17+
<style>
18+
html{background:DarkOliveGreen; line-height: 1.4em}
19+
article {background:rgba(255, 255, 255, .7); padding:2em; margin:auto; width:60%; min-width:700px;}
20+
pre {background:rgba(255, 255, 255, .6); padding: 1em;}
21+
h1,h2,h3,h4 {margin-top: 2em}
22+
code:not(pre code) {font-weight: bold}
23+
</style>
24+
</head>
25+
<body><main><article>
26+
27+
<h1 id="myba-git-based-backup-utility-with-encryption"><img src="icon.svg" width="64"/> Myba — git-based backup utility with encryption</h1>
28+
<div class="toc">
29+
<ul>
30+
<li><a href="#myba-git-based-backup-utility-with-encryption">Myba — git-based backup utility with encryption</a><ul>
31+
<li><a href="#features">Features</a></li>
32+
<li><a href="#how-it-works">How it works</a><ul>
33+
<li><a href="#use-cases">Use-cases</a></li>
34+
</ul>
35+
</li>
36+
<li><a href="#installation">Installation</a></li>
37+
<li><a href="#usage">Usage</a><ul>
38+
<li><a href="#environment-variables">Environment variables</a></li>
39+
<li><a href="#example-use">Example use</a></li>
40+
</ul>
41+
</li>
42+
</ul>
43+
</li>
44+
</ul>
45+
</div>
46+
<p><a href="https://github.com/kernc/myba/actions"><img alt="Build Status" src="https://img.shields.io/github/actions/workflow/status/kernc/myba/ci.yml?branch=master&amp;style=for-the-badge" /></a>
47+
<a href="#"><img alt="Issues" src="https://img.shields.io/github/issues/kernc/myba?style=for-the-badge" /></a>
48+
<a href="https://github.com/sponsors/kernc"><img alt="GitHub Sponsors" src="https://img.shields.io/github/sponsors/kernc?color=pink&amp;style=for-the-badge" /></a></p>
49+
<p><strong>Myba</strong> (pronounced: mỹba) <strong>is an
50+
open-source, secure, distributed, version-controlled, encrypted
51+
file backup software based on <code>git</code></strong>,
52+
for <strong>Linux, MacOS</strong>, and possibly even <strong>Windows/WSL</strong>.
53+
In a world of vice, instability, evergreen browsers, fast-moving markets and near constant <em>supply chain attacks</em>,
54+
it's the best kind of backup utility—<strong>a simple shell script</strong> that relies on few, well-tested and <em>stable</em> technologies.
55+
Its only <strong>dependencies are</strong>:</p>
56+
<ul>
57+
<li>a running <strong>shell</strong> / standard <strong>POSIX environment</strong> (sh, bash, zsh, dash, ... WSL?),</li>
58+
<li><strong>gzip</strong></li>
59+
<li><strong>git</strong> (and Git LFS for files sized &gt;40 MB),</li>
60+
<li>either <strong>OpenSSL</strong> or <strong>GPG</strong> (~4x slower) for encryption,</li>
61+
</ul>
62+
<p>all of which everyone should discover most popularly available.</p>
63+
<p><strong>Git does a great job of securely storing and tracking changes and backing up important documents,</strong>
64+
it is popular and widely-deployed,
65+
<a href="https://git-man-page-generator.lokaltog.net/">feature-rich</a>,
66+
but it doesn't on its own support encryption, which might be important if the backed-up data
67+
is going to be shared with untrusted (and untrustworthy) third parties
68+
and various intermediary data "processors".
69+
One <em>could</em> most simply set up an encryption-decryption process
70+
consisting of <a href="https://git-scm.com/book/ms/v2/Customizing-Git-Git-Attributes#filters_a"><strong><code>clean</code> and <code>smudge</code> git filters</strong> issued pre commits and post checkouts</a>,
71+
respectively, but the <strong>filters can't encrypt the tracked file paths / filenames</strong>,
72+
whereas one might have a want for that, otherwise almost what's the point? 😶</p>
73+
<h2 id="features">Features</h2>
74+
<ul>
75+
<li>Version-controlled (git-based) backup of plaintext documents as well as large binary files.</li>
76+
<li>Automatic <strong>text compression</strong> for reduced space use.</li>
77+
<li>Currently using <strong><em>strong</em> AES256 encryption</strong> of files and paths, so far quantum-safe.</li>
78+
<li>Git-based workflow: add, stage, commit, push, clone, pull, checkout.</li>
79+
<li><strong>Selective checkout</strong> of backup files, efficient size-on-disk overhead.</li>
80+
<li><strong>Sync to multiple clouds</strong> for nearly free by (ab)using popular git hosts.</li>
81+
<li><strong>Or sync anywhere simply</strong> by cloning or checking-out a directory ...</li>
82+
</ul>
83+
<h2 id="how-it-works">How it works</h2>
84+
<p>Myba relies on a two-repo solution. On any <em>client</em>, <strong>two repositories</strong> are created.
85+
<strong>One plaintext</strong> <a href="https://git-scm.com/book/en/v2/Git-on-the-Server-Getting-Git-on-a-Server"><code>--bare</code></a> repo,
86+
such as in <a href="https://www.atlassian.com/git/tutorials/dotfiles">this guide</a>,
87+
with worktree set to the root of your volume of interest, such as <code>/</code> or <code>$HOME</code>.
88+
And <strong>one encrypted</strong> repo that holds encrypted file counterparts.</p>
89+
<p>When you <code>myba commit</code> some files into the plain repo,
90+
a commit to the encrypted repo is made in the background.</p>
91+
<p>When you <code>myba checkout</code>, a file is checked out from the
92+
encrypted repo and restored back onto your volume.</p>
93+
<p>When you <code>myba push</code> your commit history successfully (exit code 0)
94+
to all configured remotes
95+
(any <code>git remote</code>, such as a special folder or a cloud host),
96+
the <strong>local encrypted blobs are deleted to save disk space</strong>,
97+
relying on recently-stabilized
98+
<a href="https://git-scm.com/docs/git-sparse-checkout"><code>git sparse-checkout</code></a> and
99+
<a href="https://git-scm.com/docs/partial-clone">partial <code>git clone --filter=blob:none</code></a> features,
100+
all in all at a minimized and efficient space cost best-suited to backing up
101+
text and configuration files, source code files, documents and pictures,
102+
including all kinds or large binary files
103+
(as much as you can afford to sync to your cloud storage),
104+
<strong>all under the assumptions that text files compress well</strong> and
105+
that <strong>large binaries don't change too often</strong>.</p>
106+
<p><strong>Myba</strong> is <strong>Git + Shell</strong>, preconfigured and wrapped as thinly as needed to provide
107+
fully <strong>encrypted backups</strong> that are really <strong>easily replicated and synced to the cloud</strong>.</p>
108+
<script src="https://ssl.gstatic.com/trends_nrtr/3826_RC01/embed_loader.js"></script>
109+
<script>window.trends.embed.renderExploreWidget("TIMESERIES", {"comparisonItem":[{"keyword":"/m/02mhh1","geo":"","time":"2004-01-01 2024-10-13"},{"keyword":"/m/05vqwg","geo":"","time":"2004-01-01 2024-10-13"},{"keyword":"/m/0ryppmg","geo":"","time":"2004-01-01 2024-10-13"}],"category":0,"property":""}, {"exploreQuery":"q=%2Fm%2F02mhh1,%2Fm%2F05vqwg,%2Fm%2F0ryppmg&date=all#TIMESERIES","guestPath":"https://trends.google.com:443/trends/embed/"})</script>
110+
111+
<h3 id="use-cases">Use-cases</h3>
112+
<ul>
113+
<li><strong>Zero-knowledge cloud sync and storage</strong></li>
114+
<li>Replace or supplement existing <strong>poor complex and proprietary solutions</strong> (like Veeam, Time Machine, Google Photos &amp; Drive, iCloud)
115+
or software programs with <strong>complex and unfamiliar CLI APIs or wide attack surfaces</strong> (Bacula, Borg Backup, restic) ...</li>
116+
<li>Cloud-based serverless virii</li>
117+
<li><strong>Protocol- and PaaS-agnostic</strong> design (AWS to Backblaze B2, GitLab to Gitea). Simply sync (even rsync) a git folder.</li>
118+
</ul>
119+
<h2 id="installation">Installation</h2>
120+
<p>To install everything on a Debian/Ubuntu-based system, run:</p>
121+
<pre><code class="language-sh"># Install dependencies
122+
sudo apt install gzip git git-lfs openssl gpg
123+
124+
# Make available somewhere in path
125+
curl -L https://bit.ly/myba-backup &gt; ~/.local/bin/myba
126+
export PATH=&quot;$HOME/.local/bin:$PATH&quot;
127+
128+
myba help
129+
</code></pre>
130+
<p>Note, only one of <code>openssl</code> <em>or</em> <code>gpg</code> is needed, not both!</p>
131+
<p>It should be similar, if not nearly equivalent, to install on other platforms.
132+
Hopefully you will find most dependencies already satisfied.</p>
133+
<p>Please report back if you find / manage to get this working under anything but the above configuration and especially Windows/WSL!</p>
134+
<h2 id="usage">Usage</h2>
135+
<p>You run the script with arguments according to the usage printout below.
136+
Myba heavily relies on <code>git</code> and thus <strong>its command-line usage largely follows that of git convention</strong>.
137+
Most subcommands pass obtained arguments and options (<code>"@"</code>) straight to matching <code>git</code> subcommands! </p>
138+
<pre><code class="language-text">Usage: myba &lt;subcommand&gt; [options]
139+
Subcommands:
140+
init Initialize repos in $WORK_TREE (default: $HOME)
141+
add [OPTS] PATH... Stage files for backup/version tracking
142+
rm PATH... Stage-remove files from future backups/version control
143+
commit [OPTS] Commit staged changes of tracked files as a snapshot
144+
push [REMOTE] Encrypt and push files to remote repo(s) (default: all)
145+
pull [REMOTE] Pull encrypted commits from a promisor remote
146+
clone REPO_URL Clone an encrypted repo and init from it
147+
remote CMD [OPTS] Manage remotes of the encrypted repo
148+
restore [--squash] Reconstruct plain repo commits from encrypted commits
149+
diff [OPTS] Compare changes between plain repo revisions
150+
log [OPTS] Show commit log of the plain repo
151+
checkout PATH... Sparse-checkout and decrypt files into $WORK_TREE
152+
checkout COMMIT Switch files to a commit of plain or encrypted repo
153+
gc Garbage collect, remove synced encrypted packs
154+
git CMD [OPTS] Inspect/execute raw git commands inside plain repo
155+
git_enc CMD [OPTS] Inspect/execute raw git commands inside encrypted repo
156+
157+
Env vars: WORK_TREE, PLAIN_REPO, PASSWORD USE_GPG, VERBOSE, YES_OVERWRITE, ...
158+
</code></pre>
159+
<p>The script also acknowledges a few <strong>environment variables</strong> which you can <em>set</em> to
160+
steer the program behavior:</p>
161+
<h3 id="environment-variables">Environment variables</h3>
162+
<ul>
163+
<li><code>WORK_TREE=</code> The root of the volume that contains important documents to back up (such as dotfiles).
164+
If unspecified, <code>$HOME</code>.</li>
165+
<li><code>PLAIN_REPO=</code> The <em>internal</em> directory where myba actually stores both its repositories.
166+
Defaults to <code>$WORK_TREE/.myba</code> but can be overriden to somewhere out-of-tree ...</li>
167+
<li><code>PASSWORD=</code> The password to use for encryption instead of asking / reading from stdin.</li>
168+
<li><code>USE_GPG=</code> Myba uses <code>openssl enc</code> by default, but if you prefer to use GPG for symmetric encryption, set <code>USE_GPG=1</code>.</li>
169+
<li><code>KDF_ITERS=</code> A sufficient number of iterations is used for the encryption key derivation function.
170+
To specify your own value and avoid rainbow table attacks on myba itself, you can customize this value.
171+
If you don't know, just leave it.</li>
172+
<li><code>YES_OVERWRITE=</code> If set, overwrite existing when restoring/checking out files that already exist in $WORK_TREE.
173+
The default is to ask instead.</li>
174+
<li><code>VERBOSE=</code> More verbose output about what the program is doing.</li>
175+
</ul>
176+
<h3 id="example-use">Example use</h3>
177+
<pre><code class="language-shell"># Set volume root to the user's $HOME and export for everyone
178+
export WORK_TREE=&quot;$HOME&quot;
179+
myba init
180+
myba add Documents Photos Etc .dotfile
181+
PASSWORD=secret myba commit -m &quot;my precious&quot;
182+
myba remote add origin &quot;/media/usb/backup&quot;
183+
myba remote add github &quot;git@github.com:user/my-backup.git&quot;
184+
myba push # Push to all configured remotes &amp; free disk space
185+
186+
# Somewhere else, much, much later, avoiding catastrophe ...
187+
188+
export WORK_TREE=&quot;$HOME&quot;
189+
PASSWORD=secret myba clone &quot;...&quot; # Clone one of the known remotes
190+
myba checkout &quot;.dotfile&quot; # Restore backed up files in a space-efficient manner
191+
</code></pre>
192+
<p>See <a href="https://github.com/kernc/myba/blob/master/smoke-test.sh"><em>smoke-test.sh</em></a> file for a more full example &amp; test case!</p></article></main></body></html>

0 commit comments

Comments
 (0)