Can I create a swift restic repo when I do a Restic_based backup ?

[sulaimanyu]

In the document, there is only a S3 restic repo as an example.
My question is can I use swift to create the restic repo in volsync backup?

If yes.

how can I setup the env parameters for swift during create volsync secret.

Thanks

[tesshuflower]

@sulaimanyu This should be possible as restic supports it - see the section of the restic docs here: https://restic.readthedocs.io/en/latest/030_preparing_a_new_repo.html#openstack-swift

Essentially you can set those vars in the restic-config secret and they should get passed into the mover pod that runs restic.

Env vars from the restic-config that get set in the mover pod can be seen here:

volsync/controllers/mover/restic/mover.go

Lines 337 to 387 in 8821a30

	// We populate environment variables from the restic repo
	// Secret. They are taken 1-for-1 from the Secret into env vars.
	// The allowed variables are defined by restic.
	// https://restic.readthedocs.io/en/stable/040_backup.html#environment-variables
	// Mandatory variables are needed to define the repository
	// location and its password.
	utils.EnvFromSecret(repo.Name, "RESTIC_REPOSITORY", false),
	utils.EnvFromSecret(repo.Name, "RESTIC_PASSWORD", false),
	// Optional variables
	utils.EnvFromSecret(repo.Name, "RESTIC_COMPRESSION", true), // New in v0.14.0
	utils.EnvFromSecret(repo.Name, "RESTIC_PACK_SIZE", true), // New in v0.14.0
	utils.EnvFromSecret(repo.Name, "RESTIC_READ_CONCURRENCY", true), // New in v0.15.0
	// Optional variables based on what backend is used for restic
	utils.EnvFromSecret(repo.Name, "AWS_ACCESS_KEY_ID", true),
	utils.EnvFromSecret(repo.Name, "AWS_SECRET_ACCESS_KEY", true),
	utils.EnvFromSecret(repo.Name, "AWS_SESSION_TOKEN", true), // New in v0.14.0
	utils.EnvFromSecret(repo.Name, "AWS_DEFAULT_REGION", true),
	utils.EnvFromSecret(repo.Name, "ST_AUTH", true),
	utils.EnvFromSecret(repo.Name, "ST_USER", true),
	utils.EnvFromSecret(repo.Name, "ST_KEY", true),
	utils.EnvFromSecret(repo.Name, "OS_AUTH_URL", true),
	utils.EnvFromSecret(repo.Name, "OS_REGION_NAME", true),
	utils.EnvFromSecret(repo.Name, "OS_USERNAME", true),
	utils.EnvFromSecret(repo.Name, "OS_USER_ID", true),
	utils.EnvFromSecret(repo.Name, "OS_PASSWORD", true),
	utils.EnvFromSecret(repo.Name, "OS_TENANT_ID", true),
	utils.EnvFromSecret(repo.Name, "OS_TENANT_NAME", true),
	utils.EnvFromSecret(repo.Name, "OS_USER_DOMAIN_NAME", true),
	utils.EnvFromSecret(repo.Name, "OS_USER_DOMAIN_ID", true),
	utils.EnvFromSecret(repo.Name, "OS_PROJECT_NAME", true),
	utils.EnvFromSecret(repo.Name, "OS_PROJECT_DOMAIN_NAME", true),
	utils.EnvFromSecret(repo.Name, "OS_PROJECT_DOMAIN_ID", true),
	utils.EnvFromSecret(repo.Name, "OS_TRUST_ID", true),
	utils.EnvFromSecret(repo.Name, "OS_APPLICATION_CREDENTIAL_ID", true),
	utils.EnvFromSecret(repo.Name, "OS_APPLICATION_CREDENTIAL_NAME", true),
	utils.EnvFromSecret(repo.Name, "OS_APPLICATION_CREDENTIAL_SECRET", true),
	utils.EnvFromSecret(repo.Name, "OS_STORAGE_URL", true),
	utils.EnvFromSecret(repo.Name, "OS_AUTH_TOKEN", true),
	utils.EnvFromSecret(repo.Name, "B2_ACCOUNT_ID", true),
	utils.EnvFromSecret(repo.Name, "B2_ACCOUNT_KEY", true),
	utils.EnvFromSecret(repo.Name, "AZURE_ACCOUNT_NAME", true),
	utils.EnvFromSecret(repo.Name, "AZURE_ACCOUNT_KEY", true),
	utils.EnvFromSecret(repo.Name, "AZURE_ACCOUNT_SAS", true), // New in v0.14.0
	utils.EnvFromSecret(repo.Name, "GOOGLE_PROJECT_ID", true),
	}
	// Rclone env vars for restic if they are in the secret
	envVars = appendRCloneEnvVars(repo, envVars)

[sulaimanyu]

Thanks very much for your quickly response.
The swift which I used now is a self-signed certificates https auth url. is there any config in volsync to ignore this tls cert?
just like parameter '--insecure-tls' in restic repo init:
restic -r swift:swift-test:/backup snapshots --insecure-tls

[tesshuflower]

You can use your own custom certificate authority for this kind of scenario - see the instructions here: https://volsync.readthedocs.io/en/stable/usage/restic/index.html#using-a-custom-certificate-authority

[sulaimanyu]

Yes. I just generated a self-signed certs. then it works.
Thank you very much