backup-secrets (1987B)
1 #!/usr/bin/env bash 2 set -euo pipefail 3 4 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" 5 OUT="${1:-$ROOT/private/keys-$(date +%Y%m%d).tar.gz.age}" 6 mkdir -p "$(dirname "$OUT")" 7 8 TMP="$(mktemp -d)" 9 echo "Using temporary directory: $TMP" 10 trap 'rm -rf "$TMP"' EXIT 11 12 mkdir -p "$TMP/gpg" "$TMP/ssh" "$TMP/age" "$TMP/skate" "$TMP/omz" 13 14 # --- GPG export --- 15 if command -v gpg >/dev/null 2>&1; then 16 gpg --export --armor > "$TMP/gpg/public-keys.asc" || true 17 gpg --export-secret-keys --armor > "$TMP/gpg/secret-keys.asc" || true 18 gpg --export-ownertrust > "$TMP/gpg/ownertrust.txt" || true 19 fi 20 21 # --- SSH backup (selected files) --- 22 if [[ -d "$HOME/.ssh" ]]; then 23 rsync -a \ 24 --include='config' \ 25 --include='known_hosts' \ 26 --include='id_*' \ 27 --exclude='*' \ 28 "$HOME/.ssh/" "$TMP/ssh/" || true 29 fi 30 31 # --- AGE identities (common locations) --- 32 for f in \ 33 "$HOME/.config/age/keys.txt" \ 34 "$HOME/.config/age/key.txt" \ 35 "$HOME/.config/age/age.key" \ 36 "$HOME/key.txt" \ 37 "$HOME/age.key" 38 do 39 [[ -f "$f" ]] && cp -p "$f" "$TMP/age/" 40 done 41 42 # --- Skate export (JSONL; values base64) --- 43 if command -v skate >/dev/null 2>&1; then 44 python3 - <<'PY' > "$TMP/skate/skate.jsonl" 45 import base64, json, subprocess 46 def sh(*cmd): 47 return subprocess.check_output(list(cmd)) 48 dbs = sh("skate","list-dbs").decode().splitlines() 49 for db in dbs: 50 keys = sh("skate","list","-k",f"{db}").decode().splitlines() 51 for k in keys: 52 v = sh("skate","get",f"{k}{db}") 53 print(json.dumps({"db": db, "key": k, "b64": base64.b64encode(v).decode()})) 54 PY 55 fi 56 57 # --- Oh-My-Zsh custom configs --- 58 if [[ -d "$HOME/.oh-my-zsh/custom" ]]; then 59 echo "Backing up Oh-My-Zsh custom configs..." 60 rsync -a "$HOME/.oh-my-zsh/custom/" "$TMP/omz/custom/" || true 61 fi 62 63 # --- Encrypt archive --- 64 echo "Creating encrypted archive: $OUT" 65 if [[ -n "${AGE_RECIPIENT:-}" ]]; then 66 tar -C "$TMP" -czf - . | age -r "$AGE_RECIPIENT" -o "$OUT" 67 else 68 tar -C "$TMP" -czf - . | age -p -o "$OUT" 69 fi 70 71 echo "Wrote: $OUT" 72