A custom Threema Safe server implementation with multi-backend support.
Currently supported backends:
- DynamoDB
- Filesystem
Threema supports third party backup servers out of the box. Simply choose "Threema Safe", "Expert settings" and deactivate "Use default server". You will be asked for your custom server endpoint and credentials.
You need go
and GOBIN
in your PATH
. Once that is done, install eee-safe
using the following command:
go install github.com/joeig/eee-safe/cmd/eee-safe@latest
After that, copy config.dist.yml
to config.yml
, replace the default settings and run the binary:
eee-safe -config=/path/to/config.yml
If you're intending to add the application to your systemd runlevel, you may want to take a look at init/eee-safe.service
.
Threema requires a valid CA certificate.
Choose one of the following storage backends:
Storage backend | DynamoDB | Filesystem |
---|---|---|
Built-in TTL | yes | no |
Thread safe | yes | no |
Works without further efforts | no | yes |
This option requires a pre-configured AWS environment.
Create a new table with the following settings:
- Table name in this example:
EEESafe
- Primary key:
backupID
- Time to live attribute:
expirationTime
- Turn backup functionality on if required.
Required IAM permissions to access the DynamoDB table (change the resource ARN if necessary):
{
"Version": "2012-10-17",
"Statement": [
{
"Sid": "MaintainEEESafeTable",
"Effect": "Allow",
"Action": [
"dynamodb:PutItem",
"dynamodb:GetItem",
"dynamodb:DeleteItem"
],
"Resource": "arn:aws:dynamodb:eu-west-1:1234567890:table/EEESafe"
}
]
}
Examples:
- Provide credential files:
~/.aws/credentials
and~/.aws/config
- Set credentials via environment variables:
export AWS_REGION="eu-west-1" export AWS_ACCESS_KEY_ID="Your Access Key ID" export AWS_SECRET_ACCESS_KEY="Your Secret Access Key"
- Use EC2 instance roles/ECS task roles/Lambda roles/... (you should always choose this option whenever possible!)
See also: https://docs.aws.amazon.com/cli/latest/userguide/cli-chap-configure.html
This option stores every backup in a dedicated file on the local filesystem.
This storage backend does currently not support thread-safety and auto-deletion of expired backups. You probably want to implement auto-deletion by using a find
cronjob.
Run eee-safe
in debug mode in order to increase the verbosity tremendously: -debug
Feel free to contribute. This is the API reference: Cryptography Whitepaper
This project follows the Standard Go Project Layout principals.