Encrypt

encrypt inbound wraps an upstream inbound and decrypts the content of each entry after reading.

Archives encrypted as a whole are decrypted by the Archive inbound itself; this wrapper is only for entries that were encrypted individually.

The wrapper chain of an inbound must mirror the wrapper chain of the outbound that produced the data, in reverse order. For example, data written through compress → encrypt → archive must be read through archive → encrypt → compress.

Structure

{
  "type": "encrypt",
  "tag": "decrypt-in",
  "algorithm": "aes-256-gcm",
  "password": "$ENCRYPTION_KEY",
  "identity": "",
  "inbound": "archive-in"
}

Fields

algorithm

Required

The encryption algorithm.

Algorithm	Description
aes-256-gcm	AES-256 in GCM mode
chacha20	ChaCha20-Poly1305

password

The encryption password. The key is derived from the password using Argon2id.

identity

A private key generated by backup-dev generate keypair.

inbound

Required

The tag of the upstream inbound.