GPG encryption wrapper for backups with rclone

Howto Guides
3

The problem is that even re-encrypting the same compressed file (that hasn't changed) will change the SHA1sum entirely. I'm planning on saving the last time the folder was backed up to an encrypted file and reading back from it to use for a find invocation (instead of the current "find all files in the directory" approach). This should get me decent incremental updates.

The thing is that restic doesn't use GPG, which means that I would have to manage yet another set of keys and don't get the free 2-factor auth that the GPG key on my Yubikey provides. As it currently stands, I encrypt these files with two keys. One of those is on my Yubikey and the other is a backup key that never leaves my laptop. This means that I could (theoretically) download my backup onto my phone and decrypt using my Yubikey, all without ever having my private key on my phone. On the other hand, if I ever lose my Yubikey (or it breaks), I still have access to all of my files through the backup key on my laptop - slightly less convenient, but nothing major.

But yeah, if there's a backup program which does the following, I'd love to hear about it:

  1. Uses GPG for encryption
  2. Obfuscates file names and sizes (probably through a similar approach of creating a tarball)
  3. Ideally compresses (B2 as the remote) - this one's a bit optional since B2 is so cheap!

So far I've found restic, duplicity, rclone crypt which do one or two of these things, but never everything together (the biggest one is that they usually don't use GPG, and from what I understand, the crypt backend doesn't hide file sizes, just their names?).

[edit] Actually, hmm...duplicity might fit the bill! Seems to use GPG and produces encrypted tar archives. Cool!

[edit2] On further inspection, I'd probably need to do a lot of post-processing, since I'd like to obscure the filename of the backup (hence I'd need to read in and keep track of the salt and name files). It's probably still doable, but...might just rely on my script for now :joy:

Thanks for pointing me in the direction of duplicity, though, even if indirectly! :wink: