From 0373273df8f4f17c766c802e2e4ee738dd865460 Mon Sep 17 00:00:00 2001 From: sneak Date: Mon, 9 Nov 2026 00:01:02 +0000 Subject: [PATCH] Say which commands need the private key, in README.md and config.example.yml The last sentence of "The private key" and the matching comment in config.example.yml named only the restore machine. snapshot verify --deep needs the key too. Both now name both commands. The "Everyday use" block gains a comment saying its next three commands run on a machine that holds the private key. Model: fable-5-1 --- README.md | 5 +++-- config.example.yml | 4 ++-- 2 files changed, 5 insertions(+), 4 deletions(-) diff --git a/README.md b/README.md index 8abef2d..3641f13 100644 --- a/README.md +++ b/README.md @@ -104,6 +104,7 @@ it the backup stops with a permission error on a protected directory. # Check that a snapshot's blobs are all present, with the listed sizes. vaultik snapshot verify +# Run the next three commands on a machine that holds the private key. # Put the private key in the environment. Reading it from the file keeps it # out of your shell history. export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)" @@ -881,8 +882,8 @@ export VAULTIK_AGE_SECRET_KEY="$(cat vaultik_backup_private_key.txt)" ``` Do not put the private key on a machine you back up. Anyone who breaks into that -machine could then decrypt its backups. Supply the key only on the machine you -restore on. +machine could then decrypt its backups. Supply the key only on the machine where +you run `snapshot restore` or `snapshot verify --deep`. ### Exclude patterns diff --git a/config.example.yml b/config.example.yml index d78982b..800fff7 100644 --- a/config.example.yml +++ b/config.example.yml @@ -17,8 +17,8 @@ age_recipients: # Age private key for decryption # Only snapshot restore and snapshot verify --deep need it. The # VAULTIK_AGE_SECRET_KEY environment variable overrides this setting -# Do not set it on a machine you back up: prefer the environment variable, -# supplied only on the machine you restore on +# Do not set it on a machine you back up. Supply the environment variable +# only on a machine where you run snapshot restore or snapshot verify --deep # Default: not set #age_secret_key: YOUR_AGE_PRIVATE_KEY