bard-backup 0.14.0 → 0.15.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 500bd736142fc1765b02fdbee4923a35dd4d09bd3cabd825706d7b64b9ad3fff
-  data.tar.gz: 07c8d6686725ebd36364da96df0e8f66d80c87ddbf3751e1a86f0e12ead8a78c
+  metadata.gz: d27a5d0b3ccda89bf0b15345414f6143ba1ef13e2b388545f32bbe980f36eb2f
+  data.tar.gz: 7ac24670444a407c21b9ce062feed27580da64d6f62f02326db65882a14d86b4
 SHA512:
-  metadata.gz: f1893706b187e49ad3a16b5fc8fa5a2de0644e522041f7d7a1d4bf9f54054ca8094956a3f26c7a83f7e598097af94726fbbb5d3dc876a5fad90e47e71a2d460d
-  data.tar.gz: eb744cd047d227b37de6b723b5e5ec027b8f1c03dd663fc735abfad2165370536a2b727c068b3d5624b64ce9e3ff79b54fc1ea925cfbb30aa6e85ba2ae0cc598
+  metadata.gz: 1adf405bb06825fe7fd2e176dc1bd4565a2200977a5dead6e2d3c92bb7415b7144a9c2f08bd6995e60afa6b0069c77428bd6e509ddbca1a470b04cfd2708f0de
+  data.tar.gz: f5870aa10fcb9df65c920c8b7516ab9f82577ad263cd5578002cec49d19c2ae223837441f1b3ec7cd71ab1df85cea5cf7fd5f46f87be62b57d41fd58edbbbee5

data/CLAUDE.md

@@ -47,17 +47,18 @@ Tests require AWS credentials at `spec/support/credentials.json`. In CI, this is
 - `Bard::Backup::FileTree.create!` syncs configured data directories to S3.
 - `Bard::Backup.restore!(at:)` downloads the backup nearest `at` (or the latest when omitted), decrypts it if necessary, and loads it into the local database via `backhoe` (drop-and-create). `Bard::Backup.available` lists the available backups (as `Bard::Backup` objects carrying timestamp and size).
 
-**Destination strategy pattern**: `Destination.build(config)` is a factory that picks the right class based on `:type`. `Destination.resolve(hashes)` is the single entry point both `Database.create!` and `Finder` use — it falls back to the configured destinations, normalizes a lone Hash/Array, and builds them. Each destination resolves its own `encryption_key` (explicit config, falling back to `Bard::Config.current.backup.encryption_key`), so callers never inject it.
+**Destination strategy pattern**: `Destination.build(config)` is a factory that picks the right class based on `:type`. `Destination.resolve(hashes)` is the single entry point both `Database.create!` and `Finder` use — it falls back to the configured destinations, normalizes a lone Hash/Array, and builds them. A destination's `encryption_key` comes from its config, which `tasks.rake` merges from the `bard_backup` Rails credentials entry; there is no other source.
 - `S3Destination` — dumps DB locally via backhoe, uploads to S3, runs `Deleter` for retention, verifies previous hour's backup
 - `UploadDestination` — dumps DB and uploads to presigned URLs (multi-threaded)
 
-**Config DSL** (loaded via `bard/plugins/backup` and `bard/plugins/encrypt`; `backup` extends `Bard::Config`, `encrypt` extends `Bard::BackupConfig`):
+**Config DSL** (loaded via `bard/plugins/backup`; `backup` extends `Bard::Config`):
 ```ruby
 backup do
   s3 "primary", path: "bucket/subfolder", region: "us-west-2"
-  encrypt true  # reads key from config/master.key
 end
 ```
+Encryption at rest is opt-in per destination via an `encryption_key` in the `bard_backup`
+credentials entry — there is no DSL toggle.
 
 **Key classes**:
 - `S3Tree` — `Data.define`-based S3 wrapper used by both `S3Destination` and `FileTree`. Methods: `list_objects`, `put_file`, `put_body`, `get`, `delete_keys`, `mv`, `empty!`. Supports encryption via `Encryptor` and STS `session_token`.

data/README.md

@@ -22,7 +22,6 @@ In a Rails app, configure destinations in `config/bard.rb` using the `Bard::Conf
 ```ruby
 backup do
   s3 "primary", path: "my-bucket/my-project", region: "us-west-2"
-  encrypt true  # optional: encrypt payloads at rest. Reads key from config/master.key.
 end
 ```
 
@@ -33,8 +32,13 @@ bard_backup:
   - name: primary
     access_key_id: ...
     secret_access_key: ...
+    encryption_key: ...  # optional: encrypts payloads at rest with AES-256-GCM
 ```
 
+Adding `encryption_key` is what turns on encryption at rest; omit it and payloads are stored
+in the clear. Changing its value makes existing backups undecryptable, so treat it as
+permanent unless you re-key deliberately.
+
 Then run via the rake tasks provided by the bundled Railtie:
 
 ```bash

data/lib/bard/backup/destination/s3_destination.rb

@@ -21,16 +21,20 @@ module Bard
         resolved_config.slice(:name, :type, :path, :region)
       end
 
+      # Credentials can supply the key, so resolve rather than reading raw config.
+      def encryption_key
+        resolved_config[:encryption_key]
+      end
+
       private
 
-      # The raw config enriched with Rails credentials (by name), defaults, the
-      # computed endpoint, and the resolved encryption key.
+      # The raw config enriched with Rails credentials (by name), defaults, and
+      # the computed endpoint.
       def resolved_config
         @resolved_config ||= begin
           credentials = RailsCredentials.find(name: config[:name])
           resolved = { type: :s3, region: "us-west-2" }.merge(credentials).merge(config)
           resolved[:endpoint] ||= "https://s3.#{resolved[:region]}.amazonaws.com"
-          resolved[:encryption_key] ||= Bard::Config.current.backup.encryption_key
           resolved
         end
       end

data/lib/bard/backup/destination.rb

@@ -11,8 +11,7 @@ module Bard
       # Normalizes destination config into built destinations: falls back to the
       # configured destinations when none are given, and accepts a lone Hash or
       # an Array. A +now+ stamps every destination with one run timestamp (an
-      # explicit per-destination +now+ still wins). Each destination resolves its
-      # own encryption key (see #encryption_key), so callers don't have to inject it.
+      # explicit per-destination +now+ still wins).
       def self.resolve(destination_hashes = nil, now: nil)
         hashes = destination_hashes || Bard::Config.current.backup.destinations
         hashes = hashes.is_a?(Hash) ? [hashes] : Array(hashes)
@@ -24,12 +23,12 @@ module Bard
         raise NotImplementedError
       end
 
-      private
-
       def encryption_key
-        config[:encryption_key] || Bard::Config.current.backup.encryption_key
+        config[:encryption_key]
       end
 
+      private
+
       def now
         @now ||= config.fetch(:now, Time.now.utc)
       end

data/lib/bard/backup/file_tree.rb

@@ -15,7 +15,6 @@ module Bard
         return if data_paths.empty?
 
         encryption_key = s3_config.delete(:encryption_key)
-        encryption_key ||= bard_config&.backup&.encryption_key
 
         s3_tree = S3Tree.new(path: "#{bucket}/#{project_name}", encryption_key: encryption_key, **s3_config)
         new(s3_tree, data_paths).call

data/lib/bard/backup/version.rb

@@ -1,6 +1,6 @@
 module Bard
   class Backup
-    VERSION = "0.14.0"
+    VERSION = "0.15.0"
   end
 end
 

data/lib/bard/backup.rb

@@ -1,6 +1,5 @@
 require "bard"
 require "bard/plugins/backup"
-require "bard/plugins/encrypt"
 require "bard/backup/database"
 require "bard/backup/file_tree"
 require "bard/backup/finder"

metadata

@@ -1,13 +1,13 @@
 --- !ruby/object:Gem::Specification
 name: bard-backup
 version: !ruby/object:Gem::Version
-  version: 0.14.0
+  version: 0.15.0
 platform: ruby
 authors:
 - Micah Geisel
 bindir: exe
 cert_chain: []
-date: 2026-07-13 00:00:00.000000000 Z
+date: 2026-08-08 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: backhoe
@@ -113,7 +113,6 @@ files:
 - lib/bard/backup/version.rb
 - lib/bard/plugins/backup.rb
 - lib/bard/plugins/backup_restore.rb
-- lib/bard/plugins/encrypt.rb
 - sig/bard/backup.rbs
 homepage: https://github.com/botandrose/bard-backup
 licenses:

data/lib/bard/plugins/encrypt.rb

@@ -1,18 +0,0 @@
-require "bard/plugins/backup"
-
-module Bard
-  class BackupConfig
-    def encrypt(value = nil)
-      if value.nil?
-        @encrypt
-      else
-        @encrypt = value
-      end
-    end
-
-    def encryption_key
-      return nil unless encrypt
-      File.read("config/master.key").strip
-    end
-  end
-end