[PATCH proxmox{,-backup} 00/20] fix #7251: implement server side encryption support for push sync jobs

Christian Ebner
2026-04-01T07:55:30Z

This patch series implements support for encrypting backup snapshots
when pushing from a source PBS instance to an untrusted remote target
PBS instance. Further, it adds support to decrypt snapshots being
encrypted on the remote source PBS when pulling the contents to the
local target PBS instance. This allows to perform full server side
encryption/decryption when syncing with a less trusted remote PBS.

In order to encrypt/decrypt snapshots, a new encryption key entity
is introduced, to be created as global instance on the PBS, placed and
managed by it's own dedicated config. Keys with secret are stored
in dedicated files so they only need to be loaded when accessing the
key, not for listing of configuration.

The sync jobs in push and pull direction are extended to receive an
additional encryption key parameter, allowing the given key to be
used for encryption/decription of snapshots, depending on the sync
direction. In order to encrypt/decrypt the contents, chunks, index
files, blobs and manifest are additionally processed, rewritten when
required.

Link to the bugtracker issue:
https://bugzilla.proxmox.com/show_bug.cgi?id=7251

proxmox:

Christian Ebner (2):
pbs-api-types: define encryption key type and schema
pbs-api-types: sync job: add optional encryption key to config

pbs-api-types/src/jobs.rs | 11 ++++++++--
pbs-api-types/src/key_derivation.rs | 34 ++++++++++++++++++++++++++---
pbs-api-types/src/lib.rs | 2 +-
3 files changed, 41 insertions(+), 6 deletions(-)

proxmox-backup:

Christian Ebner (18):
pbs-key-config: introduce store_with() for KeyConfig
pbs-config: implement encryption key config handling
pbs-config: acls: add 'encryption-keys' as valid 'system' subpath
ui: expose 'encryption-keys' as acl subpath for 'system'
api: config: add endpoints for encryption key manipulation
api: config: allow encryption key manipulation for sync job
sync: push: rewrite manifest instead of pushing pre-existing one
sync: add helper to check encryption key acls and load key
fix #7251: api: push: encrypt snapshots using configured encryption
key
ui: define and expose encryption key management menu item and windows
ui: expose assigning encryption key to sync jobs
sync: pull: load encryption key if given in job config
sync: expand source chunk reader trait by crypt config
sync: pull: introduce and use decrypt index writer if crypt config
sync: pull: extend encountered chunk by optional decrypted digest
sync: pull: decrypt blob files on pull if encryption key is configured
sync: pull: decrypt chunks and rewrite index file for matching key
sync: pull: decrypt snapshots with matching encryption key fingerprint

pbs-config/Cargo.toml | 1 +
pbs-config/src/acl.rs | 4 +-
pbs-config/src/encryption_keys.rs | 159 +++++++++++
pbs-config/src/lib.rs | 1 +
pbs-key-config/src/lib.rs | 36 ++-
src/api2/config/encryption_keys.rs | 115 ++++++++
src/api2/config/mod.rs | 2 +
src/api2/config/sync.rs | 10 +
src/api2/pull.rs | 15 +-
src/api2/push.rs | 14 +-
src/server/pull.rs | 416 ++++++++++++++++++++++++-----
src/server/push.rs | 222 +++++++++++----
src/server/sync.rs | 57 +++-
www/Makefile | 3 +
www/NavigationTree.js | 6 +
www/Utils.js | 1 +
www/config/EncryptionKeysView.js | 143 ++++++++++
www/form/EncryptionKeySelector.js | 59 ++++
www/form/PermissionPathSelector.js | 1 +
www/window/EncryptionKeysEdit.js | 382 ++++++++++++++++++++++++++
www/window/SyncJobEdit.js | 11 +
21 files changed, 1512 insertions(+), 146 deletions(-)
create mode 100644 pbs-config/src/encryption_keys.rs
create mode 100644 src/api2/config/encryption_keys.rs
create mode 100644 www/config/EncryptionKeysView.js
create mode 100644 www/form/EncryptionKeySelector.js
create mode 100644 www/window/EncryptionKeysEdit.js

Summary over all repositories:
24 files changed, 1553 insertions(+), 152 deletions(-)

--
Generated by murpp 0.11.0