fix backup

system/backup-env.sh

@@ -0,0 +1,44 @@
+#!/bin/bash
+#
+# Purpose : Point restic at your backup in your Nextcloud files. Sourced by
+#           system/backup and configure.d/20-backup.sh, and by you to look at
+#           or restore from a backup:
+#
+#             source ~/.local/share/coredesktop/system/backup-env.sh
+#             restic snapshots
+#
+#           To use another computer's backup, name its folder:
+#
+#             source ~/.local/share/coredesktop/system/backup-env.sh .backup-<name>
+#
+# restic reaches Nextcloud over WebDAV through rclone, not the davfs2 mount,
+# which can't safely replace files. The Nextcloud app password and the
+# backup's passphrase are kept in your keyring.
+
+BACKUP_CONF="$HOME/.config/coredesktop/backup.conf"
+
+# A secret from the keyring: nextcloud (app password) or passphrase
+backup_secret() {
+  secret-tool lookup coredesktop backup item "$1" url "$2"
+}
+
+if [ -f "$BACKUP_CONF" ]; then
+  source "$BACKUP_CONF"
+  BACKUP_DIR="${1:-$BACKUP_DIR}"
+
+  export RCLONE_WEBDAV_URL="$BACKUP_WEBDAV"
+  export RCLONE_WEBDAV_VENDOR=nextcloud
+  export RCLONE_WEBDAV_USER="$BACKUP_USER"
+  RCLONE_WEBDAV_PASS="$(backup_secret nextcloud "$BACKUP_WEBDAV" | rclone obscure -)"
+  export RCLONE_WEBDAV_PASS
+  export RESTIC_REPOSITORY="rclone::webdav:$BACKUP_DIR"
+
+  # Without a passphrase in the keyring, e.g. for another computer's backup,
+  # restic asks for it
+  unset RESTIC_PASSWORD_COMMAND
+  if [ -n "$(backup_secret passphrase "$BACKUP_WEBDAV/$BACKUP_DIR")" ]; then
+    export RESTIC_PASSWORD_COMMAND="secret-tool lookup coredesktop backup item passphrase url $BACKUP_WEBDAV/$BACKUP_DIR"
+  fi
+else
+  echo "Backups aren't set up. Run: configure backup" >&2
+fi