Configure repository

S3 storage

To create a repository stored on an S3-compatible server, create an INI file (name it how you want) with the following configuration:

[Repository]
URL = https://<endpoint>/<bucket>

[S3]
AccessKeyID = <AWS access key ID>
SecretKey = <AWS secret key>

To help you form a valid URL, here are a few examples for common S3 providers:

You can omit the SecretKey value, in which case a prompt will ask you the access key.

Once this is done, use rekkord init to create the repository.

SFTP server

To create a repository stored on an SFTP host, create an INI file (name it how you want) with the following configuration:

[Repository]
URL = <user>@<host>:/path/to/repository

[SFTP]
Password = <SSH password>
KeyFile = <SSH keyfile>

Use either a password or a key file. If you omit both, a prompt will ask you for a password.

Just like with ssh, you will need to validate the host fingerprint the first time you connect to it. However, you can instead directly provide the correct host fingerprint as the Fingerprint to avoid this, as shown in the example below:

[Repository]
URL = foo@example.com:/backup

[SFTP]
KeyFile = /home/bar/.ssh/id_ed25519
Fingerprint = SHA256:Y9pmJfkaok8t0dFJrfi8/LLUNhOYwAZGHUNGsYAiJUM

Once this is done, use rekkord init to create the repository.

Local filesystem

To create a repository in a local directory, create an INI file (name it how you want) with the following configuration:

[Repository]
URL = /path/to/repository

Once this is done, use rekkord init to create the repository.

Initialize repository

Once you have configured your repository, through a configuration file or with environment variables, you can initialize it with the following command:

export REKKORD_CONFIG_FILE=/path/to/config.ini
rekkord init

# Alternative: rekkord init -C /path/to/config.ini

This command will initialize the repository with a random 256-bit master key.

After initialization, the master key is exported to a binary file, named master.key by default (in the current directory). You can change the export file with the --key_file <file> option.

Rekkord uses multiple encryption keys which are derived from this master key:

• The config key (ckey) is paired with an access key (akey) to sign config files and user keyfiles
• The data key (dkey) is paired with a write key (wkey) for data encryption (snapshot information, directory metadata, file content)
• The log key (lkey) is paired with a tag key (tkey), to manage snapshots and record snapshot information

For simple use cases, you can simply use the master key for everything. However, we recommend that you create restricted keyfiles, for two reasons:

• Each restricted keyfile can have limited capabilities: Admin, ReadWrite, WriteOnly or LogOnly
• Snapshots are signed with each keyfile-specific signing key, this can be used to detect cross-server tampering during repository checks

Restricted keys

The master key can do everything. It is possible to create restricted keyfiles with limited capabilities; these keyfiles only contain the encryption keys needed to perform the correspond action, and nothing else.

At the moment, Rekkord supports three kinds of restricted keyfiles:

In addition, each keyfile has its own key pair with which snapshots are signed. These signatures are checked during repository scans.

You must use the master key to create a restricted (or derived) keyfile. Use the rekkord derive command to create a restricted keyfile:

export REKKORD_CONFIG_FILE=/path/to/config.ini

rekkord derive -K master.key -t ReadWrite -O readwrite.key
rekkord derive -K master.key -t WriteOnly -O write.key

Most Rekkord commands require you to specify the keyfile, you can do this in one of two ways:

• Set the REKKORD_KEYFILE environment variable (e.g. export REKKORD_KEYFILE=write.key)
• Set the KeyFile setting in the Repository section of the config file (see example below)

[Repository]
URL = ssh://foo@example.com/backup
KeyFile = write.key

[SFTP]
KeyFile = <SSH keyfile>
Fingerprint = SHA256:<fingerprint>