[PATCH proxmox-backup v2 15/27] sync: push: optionally encrypt data blob on upload

Christian Ebner
2026-04-10T16:55:02Z

Encrypt the data blob with given encryption key during syncs in push
direction, if given.

Introduces a helper to read and decode the data blob from source into
raw data and re-encrypt, so the new blob is compressed and encrypted,
including the correct header when uploading. The same helper will be
reused for client log uploads in subsequent code changes.

Signed-off-by: Christian Ebner <c.ebner@proxmox.com>
---
src/server/push.rs | 39 +++++++++++++++++++++++++++++++++------
1 file changed, 33 insertions(+), 6 deletions(-)

diff --git a/src/server/push.rs b/src/server/push.rs
index 93434bedc..7ce47e32e 100644
--- a/src/server/push.rs
+++ b/src/server/push.rs
@@ -1,6 +1,7 @@
//! Sync datastore by pushing contents to remote server

use std::collections::HashSet;
+use std::path::Path;
use std::sync::{Arc, Mutex};

use anyhow::{bail, format_err, Context, Error};
@@ -26,7 +27,7 @@ use pbs_datastore::dynamic_index::DynamicIndexReader;
use pbs_datastore::fixed_index::FixedIndexReader;
use pbs_datastore::index::IndexFile;
use pbs_datastore::read_chunk::AsyncReadChunk;
-use pbs_datastore::{BackupManifest, DataStore, StoreProgress};
+use pbs_datastore::{BackupManifest, DataBlob, DataStore, StoreProgress};
use pbs_tools::crypt_config::CryptConfig;

use super::sync::{
@@ -849,6 +850,8 @@ pub(crate) async fn push_snapshot(
return Ok(stats);
}

+ let mut encrypt_using_key = None;
+
// Writer instance locks the snapshot on the remote side
let backup_writer = BackupWriter::start(
&params.target.client,
@@ -856,7 +859,7 @@ pub(crate) async fn push_snapshot(
datastore: params.target.repo.store(),
ns: &target_ns,
backup: snapshot,
- crypt_config: None,
+ crypt_config: encrypt_using_key.clone(),
debug: false,
benchmark: false,
no_cache: false,
@@ -901,10 +904,20 @@ pub(crate) async fn push_snapshot(
let archive_name = BackupArchiveName::from_path(&entry.filename)?;
match archive_name.archive_type() {
ArchiveType::Blob => {
- let file = std::fs::File::open(&path)?;
- let backup_stats = backup_writer
- .upload_blob(file, archive_name.as_ref())
- .await?;
+ let backup_stats = if encrypt_using_key.is_some() {
+ reencode_encrypted_and_upload_blob(
+ path,
+ &archive_name,
+ &backup_writer,
+ &upload_options,
+ )
+ .await?
+ } else {
+ let file = std::fs::File::open(&path)?;
+ backup_writer
+ .upload_blob(file, archive_name.as_ref())
+ .await?
+ };
target_manifest.add_file(
&archive_name,
backup_stats.size,
@@ -1039,6 +1052,20 @@ pub(crate) async fn push_snapshot(
Ok(stats)
}

+async fn reencode_encrypted_and_upload_blob<P: AsRef<Path>>(
+ path: P,
+ archive_name: &BackupArchiveName,
+ backup_writer: &BackupWriter,
+ upload_options: &UploadOptions,
+) -> Result<BackupStats, Error> {
+ let mut file = tokio::fs::File::open(&path).await?;
+ let data_blob = DataBlob::load_from_async_reader(&mut file).await?;
+ let raw_data = data_blob.decode(None, None)?;
+ backup_writer
+ .upload_blob_from_data(raw_data, archive_name.as_ref(), upload_options.clone())
+ .await
+}
+
// Read fixed or dynamic index and push to target by uploading via the backup writer instance
//
// For fixed indexes, the size must be provided as given by the index reader.
--
2.47.3