Re: [PATCH proxmox{,-backup} 00/20] fix #7251: implement server side encryption support for push sync jobs

[Manuel Federanko <m.federanko@proxmox.com>]

On 2026-04-01 9:55 AM, Christian Ebner wrote:
> This patch series implements support for encrypting backup snapshots
> when pushing from a source PBS instance to an untrusted remote target
> PBS instance. Further, it adds support to decrypt snapshots being
> encrypted on the remote source PBS when pulling the contents to the
> local target PBS instance. This allows to perform full server side
> encryption/decryption when syncing with a less trusted remote PBS.
> 
> In order to encrypt/decrypt snapshots, a new encryption key entity
> is introduced, to be created as global instance on the PBS, placed and
> managed by it's own dedicated config. Keys with secret are stored
> in dedicated files so they only need to be loaded when accessing the
> key, not for listing of configuration.
> 
> The sync jobs in push and pull direction are extended to receive an
> additional encryption key parameter, allowing the given key to be
> used for encryption/decription of snapshots, depending on the sync
> direction. In order to encrypt/decrypt the contents, chunks, index
> files, blobs and manifest are additionally processed, rewritten when
> required.
> 
> Link to the bugtracker issue:
> https://bugzilla.proxmox.com/show_bug.cgi?id=7251
> 

I just had a go at this, looks good overall, a couple of issues:

it's not possible to not specify a encryption key during sync job
creation, the dialog fails with an error:
> "encryption-key: value must be at least 3 characters long"
it still works via the cli

creating a sync job with a unknown encryption key silently succeeds,
leaving the key unset (via the cli)

nit: the encryption key name length check is inconsistent, I can only
create keys where the name is 4 characters or longer, the check
for a sync job is 3 characters

when removing a encryption key a "unknown error" is displayed to
 the user

adding a key which is password protected works, which we could
 already check against, to prevent later failures in sync jobs.

a pull sync which had a correct key set will decrypt a backup
switching a key from that pull job (or starting another pull
job with a different key) will mark the backup as corrupt and
re-sync it, replacing the decrypted backup with a encrypted one.
> re-sync snapshot host/tali/2026-04-07T14:35:30Z
> detected changed file "/mnt/datastore/zfs0/host/tali/2026-04-07T14:35:30Z/config.pxar.didx" - wrong checksum for file 'config.pxar.didx'
I'm not sure we even want to allow that since that setup is
inherently at odds.


apologies if some of these issues are already touched upon by the
others.

Other than that it lgtm and works as expected.