From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id D6E051FF13A for ; Wed, 01 Apr 2026 09:55:30 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 9413010A35; Wed, 1 Apr 2026 09:55:50 +0200 (CEST) From: Christian Ebner To: pbs-devel@lists.proxmox.com Subject: [PATCH proxmox{,-backup} 00/20] fix #7251: implement server side encryption support for push sync jobs Date: Wed, 1 Apr 2026 09:55:01 +0200 Message-ID: <20260401075521.176354-1-c.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1775030085676 X-SPAM-LEVEL: Spam detection results: 0 AWL -1.437 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment RCVD_IN_VALIDITY_CERTIFIED_BLOCKED 1 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_RPBL_BLOCKED 1 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. RCVD_IN_VALIDITY_SAFE_BLOCKED 1 ADMINISTRATOR NOTICE: The query to Validity was blocked. See https://knowledge.validity.com/hc/en-us/articles/20961730681243 for more information. SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: 7XAJ4UYB3P7X7IG2FXD2EWT2IHZGK6JI X-Message-ID-Hash: 7XAJ4UYB3P7X7IG2FXD2EWT2IHZGK6JI X-MailFrom: c.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox Backup Server development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: This patch series implements support for encrypting backup snapshots when pushing from a source PBS instance to an untrusted remote target PBS instance. Further, it adds support to decrypt snapshots being encrypted on the remote source PBS when pulling the contents to the local target PBS instance. This allows to perform full server side encryption/decryption when syncing with a less trusted remote PBS. In order to encrypt/decrypt snapshots, a new encryption key entity is introduced, to be created as global instance on the PBS, placed and managed by it's own dedicated config. Keys with secret are stored in dedicated files so they only need to be loaded when accessing the key, not for listing of configuration. The sync jobs in push and pull direction are extended to receive an additional encryption key parameter, allowing the given key to be used for encryption/decription of snapshots, depending on the sync direction. In order to encrypt/decrypt the contents, chunks, index files, blobs and manifest are additionally processed, rewritten when required. Link to the bugtracker issue: https://bugzilla.proxmox.com/show_bug.cgi?id=7251 proxmox: Christian Ebner (2): pbs-api-types: define encryption key type and schema pbs-api-types: sync job: add optional encryption key to config pbs-api-types/src/jobs.rs | 11 ++++++++-- pbs-api-types/src/key_derivation.rs | 34 ++++++++++++++++++++++++++--- pbs-api-types/src/lib.rs | 2 +- 3 files changed, 41 insertions(+), 6 deletions(-) proxmox-backup: Christian Ebner (18): pbs-key-config: introduce store_with() for KeyConfig pbs-config: implement encryption key config handling pbs-config: acls: add 'encryption-keys' as valid 'system' subpath ui: expose 'encryption-keys' as acl subpath for 'system' api: config: add endpoints for encryption key manipulation api: config: allow encryption key manipulation for sync job sync: push: rewrite manifest instead of pushing pre-existing one sync: add helper to check encryption key acls and load key fix #7251: api: push: encrypt snapshots using configured encryption key ui: define and expose encryption key management menu item and windows ui: expose assigning encryption key to sync jobs sync: pull: load encryption key if given in job config sync: expand source chunk reader trait by crypt config sync: pull: introduce and use decrypt index writer if crypt config sync: pull: extend encountered chunk by optional decrypted digest sync: pull: decrypt blob files on pull if encryption key is configured sync: pull: decrypt chunks and rewrite index file for matching key sync: pull: decrypt snapshots with matching encryption key fingerprint pbs-config/Cargo.toml | 1 + pbs-config/src/acl.rs | 4 +- pbs-config/src/encryption_keys.rs | 159 +++++++++++ pbs-config/src/lib.rs | 1 + pbs-key-config/src/lib.rs | 36 ++- src/api2/config/encryption_keys.rs | 115 ++++++++ src/api2/config/mod.rs | 2 + src/api2/config/sync.rs | 10 + src/api2/pull.rs | 15 +- src/api2/push.rs | 14 +- src/server/pull.rs | 416 ++++++++++++++++++++++++----- src/server/push.rs | 222 +++++++++++---- src/server/sync.rs | 57 +++- www/Makefile | 3 + www/NavigationTree.js | 6 + www/Utils.js | 1 + www/config/EncryptionKeysView.js | 143 ++++++++++ www/form/EncryptionKeySelector.js | 59 ++++ www/form/PermissionPathSelector.js | 1 + www/window/EncryptionKeysEdit.js | 382 ++++++++++++++++++++++++++ www/window/SyncJobEdit.js | 11 + 21 files changed, 1512 insertions(+), 146 deletions(-) create mode 100644 pbs-config/src/encryption_keys.rs create mode 100644 src/api2/config/encryption_keys.rs create mode 100644 www/config/EncryptionKeysView.js create mode 100644 www/form/EncryptionKeySelector.js create mode 100644 www/window/EncryptionKeysEdit.js Summary over all repositories: 24 files changed, 1553 insertions(+), 152 deletions(-) -- Generated by murpp 0.11.0