bard-backup 0.15.2 → 0.16.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 4dd726619aabc1410bb02866fffa6e94df6110a121aa797e634feb0626a0c060
-  data.tar.gz: 075d4087afa0d9ef15dd71f2e5e8c1da26f7eaa35b1df8827ae46edb88e8b796
+  metadata.gz: b04f7c45bf80b1e66501cde66ca37f02def6a887368710c18ebbb6b12e8dd906
+  data.tar.gz: 2ae3f5a68b9fd1d3166475917b3c0abfdecad4d4e9fdcdba6ebf0f8397f38659
 SHA512:
-  metadata.gz: f79d15e553a38bc6f01b5c932f8be14ed1cdf871f5b31f82c5c189d8ccc1ce57e51e4f1e405e144a66c99c57be9221bc3fafa5618b63b3b58af5e4ec2d1d9619
-  data.tar.gz: 1b17ee9f5d0d85bf0c5915ef3c6aaecdede4cfef045881c4048bf81e396754714ccd09e45db6240a1edc5b2638a9f8299f2126012188cd47ac9f7da288ab1a86
+  metadata.gz: 3647ba74dbeaad6cc519d8cb6a6e8a00166c53a8f885891435d3fd4e800d0a5388395176bdc5ca9b76af3d607de6138fadc845df6a946f32fd7591042c6fa1f1
+  data.tar.gz: d58dc757b0738f1f0dc1547fe15cf236e95d51f0843a204c1d5e2df8d671c560f4bf237ec27217991d26f241b6f03c036c6a8b8ef889466a55ceb127efb59874

data/CLAUDE.md

@@ -68,6 +68,7 @@ credentials entry — there is no DSL toggle.
 - `LocalBackhoe` / `CachedLocalBackhoe` — database dump strategies (cached variant avoids conflicts when running parallel destinations)
 - `Finder` — lists backups across destinations and selects one: by timestamp (nearest match), the latest, or the most-recent as a `Bard::Backup` (with size + destination info). `#available` returns one `Bard::Backup` per timestamp (with size) for listing. Backs `Bard::Backup.available`/`.latest` and `Restore`
 - `Restore` — downloads the backup selected by `Finder`, decrypts it via `S3Tree#get`, and loads it into the local database via backhoe (drop-and-create). Backs `Bard::Backup.restore!`
+- `Rekey` — rewrites every object under an S3 path so it is encrypted under a key (from plaintext, or from an old key via `from_key:`), skipping objects already under it and reading each rewrite back. Backs `Bard::Backup.encrypt_existing!` and `bard:backup:encrypt`
 - `BackupConfig` — the `backup do ... end` DSL surface (`bard`, `disabled`, `s3 name, **kwargs`); `create!` reads `bard_config.backup.destinations` from it
-- `Railtie` — loads `tasks.rake` which provides `bard:backup` (DB + data), `bard:backup:data` (data only), and `bard:backup:restore[at]` (restore/list) rake tasks in Rails apps
+- `Railtie` — loads `tasks.rake` which provides `bard:backup` (DB + data), `bard:backup:data` (data only), `bard:backup:encrypt` (encrypt pre-key backups and data files), and `bard:backup:restore[at]` (restore/list) rake tasks in Rails apps
 - `bard/plugins/backup_restore.rb` — registers the `bard backup restore [TIMESTAMP]` CLI subcommand (loaded by the `bard` CLI via `Gem.find_files`); shells out to the `bard:backup:restore` rake task

data/README.md

@@ -39,11 +39,17 @@ Adding `encryption_key` is what turns on encryption at rest; omit it and payload
 in the clear. Changing its value makes existing backups undecryptable, so treat it as
 permanent unless you re-key deliberately.
 
+Adding a key only encrypts what is uploaded afterwards. Database dumps stored before it still
+restore (they are recognized as plain gzip), and `rake bard:backup:encrypt` rewrites them and
+the data file tree in place under the key, verifying each object as it goes. It skips anything
+already encrypted, so it is safe to rerun.
+
 Then run via the rake tasks provided by the bundled Railtie:
 
 ```bash
-rake bard:backup        # database backup + data file-tree sync
-rake bard:backup:data   # data file-tree sync only
+rake bard:backup          # database backup + data file-tree sync
+rake bard:backup:data     # data file-tree sync only
+rake bard:backup:encrypt  # encrypt everything stored before encryption_key was added
 ```
 
 ## Restoring

data/lib/bard/backup/destination/s3_destination.rb

@@ -14,7 +14,12 @@ module Bard
       end
 
       def s3_tree
-        @s3_tree ||= S3Tree.new(**resolved_config.slice(:endpoint, :path, :access_key_id, :secret_access_key, :session_token, :region, :encryption_key).compact)
+        @s3_tree ||= S3Tree.new(**s3_tree_config, **resolved_config.slice(:encryption_key).compact)
+      end
+
+      # The connection alone, without the key, so a re-key can read objects as stored.
+      def s3_tree_config
+        resolved_config.slice(:endpoint, :path, :access_key_id, :secret_access_key, :session_token, :region).compact
       end
 
       def info

data/lib/bard/backup/encryptor.rb

@@ -21,6 +21,7 @@ module Bard
 
       def decrypt(data)
         data = data.b if data.encoding != Encoding::BINARY
+        raise OpenSSL::Cipher::CipherError, "too short to be ciphertext" if data.bytesize < 28
         cipher = OpenSSL::Cipher.new("aes-256-gcm")
         cipher.decrypt
         cipher.key = @encrypt_key

data/lib/bard/backup/file_tree.rb

@@ -8,16 +8,21 @@ module Bard
       MANIFEST_PATH = ".bard-file-tree-sync.json"
       DEFAULT_BUCKET = "bard-data"
 
-      def self.create!(data_paths: nil, project_name: nil, bucket: DEFAULT_BUCKET, **s3_config)
-        bard_config = defined?(Bard::Config) ? Bard::Config.current : nil
-        data_paths ||= bard_config&.data || []
-        project_name ||= bard_config&.project_name
-        return if data_paths.empty?
+      def self.create!(data_paths: nil, **options)
+        data_paths ||= configured_data_paths
+        tree_config = s3_tree_config(data_paths:, **options)
+        new(S3Tree.new(**tree_config), data_paths).call if tree_config
+      end
 
-        encryption_key = s3_config.delete(:encryption_key)
+      def self.s3_tree_config(data_paths: nil, project_name: nil, bucket: DEFAULT_BUCKET, **s3_config)
+        data_paths ||= configured_data_paths
+        return if data_paths.empty?
+        project_name ||= Bard::Config.current.project_name if defined?(Bard::Config)
+        { path: "#{bucket}/#{project_name}", **s3_config }
+      end
 
-        s3_tree = S3Tree.new(path: "#{bucket}/#{project_name}", encryption_key: encryption_key, **s3_config)
-        new(s3_tree, data_paths).call
+      def self.configured_data_paths
+        defined?(Bard::Config) ? Bard::Config.current.data : []
       end
 
       def initialize(s3_tree, data_paths)

data/lib/bard/backup/rekey.rb

@@ -0,0 +1,63 @@
+require "bard/backup/s3_tree"
+require "bard/backup/encryptor"
+require "bard/backup/destination"
+
+module Bard
+  class Backup
+    class Rekey < Struct.new(:tree_config, :to_key, :from_key, keyword_init: true)
+      def self.call(...)
+        new(...).call
+      end
+
+      def call
+        result = { path: tree_config[:path], encrypted: [], skipped: [] }
+        stored_tree.files.each do |file|
+          stored = stored_tree.get(file).b
+          if under_target_key?(stored)
+            result[:skipped] << file
+          else
+            rewrite(file, stored)
+            result[:encrypted] << file
+          end
+        end
+        result
+      end
+
+      private
+
+      def rewrite(file, stored)
+        body = from_key ? Encryptor.new(from_key).decrypt(stored) : stored
+        target_tree.put_body(file, body)
+        return if reads_back?(file, body)
+
+        stored_tree.put_body(file, stored)
+        raise Error, "#{file} did not read back intact after encrypting, so its original was put back"
+      end
+
+      def reads_back?(file, body)
+        target_tree.get(file).b == body
+      rescue OpenSSL::Cipher::CipherError
+        false
+      end
+
+      def under_target_key?(stored)
+        target_encryptor.decrypt(stored)
+        true
+      rescue OpenSSL::Cipher::CipherError
+        false
+      end
+
+      def stored_tree
+        @stored_tree ||= S3Tree.new(**tree_config)
+      end
+
+      def target_tree
+        @target_tree ||= S3Tree.new(**tree_config, encryption_key: to_key)
+      end
+
+      def target_encryptor
+        @target_encryptor ||= Encryptor.new(to_key)
+      end
+    end
+  end
+end

data/lib/bard/backup/s3_tree.rb

@@ -72,7 +72,7 @@ module Bard
           key: [folder_prefix, remote_key].compact.join("/"),
         })
         body = response.body.read
-        body = encryptor.decrypt(body) if encryptor
+        body = decrypt(body) if encryptor
         body
       end
 
@@ -113,6 +113,14 @@ module Bard
         Encryptor.new(encryption_key) if encryption_key
       end
 
+      def decrypt(body)
+        encryptor.decrypt(body)
+      rescue OpenSSL::Cipher::CipherError
+        body = body.b
+        raise unless body.start_with?("\x1f\x8b".b) # a database dump stored before encryption was enabled
+        body
+      end
+
       def client
         Aws::S3::Client.new({
           endpoint: endpoint,

data/lib/bard/backup/tasks.rake

@@ -19,6 +19,20 @@ namespace :bard do
       Bard::Backup::FileTree.create!(**Bard::Backup::RailsCredentials.find)
     end
 
+    desc "Encrypt the backups and data files stored before encryption was enabled"
+    task :encrypt => :environment do
+      require "bard/backup"
+      require "bard/backup/rails_credentials"
+
+      destinations = Bard::Config.current.backup.destinations.map do |dest|
+        Bard::Backup::RailsCredentials.find(name: dest[:name]).merge(dest)
+      end
+
+      Bard::Backup.encrypt_existing!(destinations, **Bard::Backup::RailsCredentials.find).each do |result|
+        puts "#{result[:path]}: encrypted #{result[:encrypted].size}, already encrypted #{result[:skipped].size}"
+      end
+    end
+
     desc "Restore the database backup nearest a timestamp (no timestamp lists available backups)"
     task :restore, [:at] => :environment do |_task, args|
       require "bard/backup"

data/lib/bard/backup/version.rb

@@ -1,6 +1,6 @@
 module Bard
   class Backup
-    VERSION = "0.15.2"
+    VERSION = "0.16.0"
   end
 end
 

data/lib/bard/backup.rb

@@ -4,6 +4,7 @@ require "bard/backup/database"
 require "bard/backup/file_tree"
 require "bard/backup/finder"
 require "bard/backup/restore"
+require "bard/backup/rekey"
 require "bard/backup/railtie" if defined?(Rails)
 
 module Bard
@@ -16,6 +17,24 @@ module Bard
       backup
     end
 
+    def self.encrypt_existing!(destination_hashes = nil, **config)
+      destination_hashes = [config] if destination_hashes.nil? && !config.empty?
+      trees = Destination.resolve(destination_hashes)
+        .select { |destination| destination.respond_to?(:s3_tree_config) }
+        .map { |destination| [destination.s3_tree_config, destination.encryption_key, destination.info[:name]] }
+
+      file_tree_config = FileTree.s3_tree_config(**config.slice(*FILE_TREE_KEYS, :data_paths, :project_name, :bucket))
+      if file_tree_config
+        key = file_tree_config.delete(:encryption_key)
+        trees << [file_tree_config, key, file_tree_config[:path]]
+      end
+
+      missing = trees.reject { |_, key, _| key }.map(&:last)
+      raise Error, "No encryption_key for #{missing.join(", ")}" if missing.any?
+
+      trees.map { |tree_config, key, _| Rekey.call(tree_config:, to_key: key) }
+    end
+
     def self.latest
       Finder.new.latest
     end

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bard-backup
 version: !ruby/object:Gem::Version
-  version: 0.15.2
+  version: 0.16.0
 platform: ruby
 authors:
 - Micah Geisel
 bindir: exe
 cert_chain: []
-date: 2026-11-03 00:00:00.000000000 Z
+date: 2026-11-13 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: backhoe
@@ -107,6 +107,7 @@ files:
 - lib/bard/backup/local_backhoe.rb
 - lib/bard/backup/rails_credentials.rb
 - lib/bard/backup/railtie.rb
+- lib/bard/backup/rekey.rb
 - lib/bard/backup/restore.rb
 - lib/bard/backup/s3_tree.rb
 - lib/bard/backup/tasks.rake