[PATCH pmg-api 04/15] fix #3226: pbs backup: remote: add encryption key support

[Stoiko Ivanov <s.ivanov@proxmox.com>]

semantically this is copied from pve-storage while using
PVE::PBSClient.

tested with `pmgbackup proxmox-backup remote`

Signed-off-by: Stoiko Ivanov <s.ivanov@proxmox.com>
---
 src/PMG/API2/PBS/Remote.pm | 46 ++++++++++++++++++++++++++++++++++++++
 src/PMG/PBSConfig.pm       |  6 +++++
 2 files changed, 52 insertions(+)

diff --git a/src/PMG/API2/PBS/Remote.pm b/src/PMG/API2/PBS/Remote.pm
index e5d63e68..881ab127 100644
--- a/src/PMG/API2/PBS/Remote.pm
+++ b/src/PMG/API2/PBS/Remote.pm
@@ -3,6 +3,8 @@ package PMG::API2::PBS::Remote;
 use strict;
 use warnings;
 
+use JSON;
+
 use PVE::SafeSyslog;
 use PVE::Tools qw(extract_param);
 use PVE::JSONSchema qw(get_standard_option);
@@ -84,6 +86,26 @@ __PACKAGE__->register_method({
             my $pbs = PVE::PBSClient->new($remotecfg, $remote, $conf->{secret_dir});
             $pbs->set_password($password) if defined($password);
 
+            my $encryption_key = extract_param($remotecfg, 'encryption-key');
+
+            if (defined($encryption_key)) {
+                my $decoded_key;
+                if ($encryption_key eq 'autogen') {
+                    $encryption_key = $pbs->autogen_encryption_key();
+                    $decoded_key = decode_json($encryption_key);
+                } else {
+                    $decoded_key = eval { decode_json($encryption_key) };
+                    if ($@ || !exists($decoded_key->{data})) {
+                        die
+                            "Value does not seems like a valid, JSON formatted encryption key!\n";
+                    }
+                    $pbs->set_encryption_key($encryption_key);
+                }
+                $remotecfg->{'encryption-key'} = $decoded_key->{fingerprint} || 1;
+            } else {
+                $pbs->delete_encryption_key();
+            }
+
             $ids->{$remote} = $remotecfg;
             $conf->write();
         };
@@ -164,6 +186,9 @@ __PACKAGE__->register_method({
                 if ($opt eq 'password') {
                     $pbs->delete_password();
                 }
+                if ($opt eq 'encryption-key') {
+                    $pbs->delete_encryption_key();
+                }
                 delete $ids->{$remote}->{$opt};
             }
 
@@ -171,6 +196,26 @@ __PACKAGE__->register_method({
                 $pbs->set_password($password);
             }
 
+            if (exists($param->{'encryption-key'})) {
+                if (defined(my $encryption_key = extract_param($param, 'encryption-key'))) {
+                    my $decoded_key;
+                    if ($encryption_key eq 'autogen') {
+                        $encryption_key = $pbs->autogen_encryption_key();
+                        $decoded_key = decode_json($encryption_key);
+                    } else {
+                        $decoded_key = eval { decode_json($encryption_key) };
+                        if ($@ || !exists($decoded_key->{data})) {
+                            die
+                                "Value does not seems like a valid, JSON formatted encryption key!\n";
+                        }
+                        $pbs->set_encryption_key($encryption_key);
+                    }
+                    $param->{'encryption-key'} = $decoded_key->{fingerprint} || 1;
+                } else {
+                    $pbs->delete_encryption_key();
+                }
+            }
+
             my $remoteconfig = PMG::PBSConfig->check_config($remote, $param, 0, 1);
 
             foreach my $p (keys %$remoteconfig) {
@@ -217,6 +262,7 @@ __PACKAGE__->register_method({
 
             my $pbs = PVE::PBSClient->new($ids->{$remote}, $remote, $conf->{secret_dir});
             $pbs->delete_password();
+            $pbs->delete_encryption_key();
             delete $ids->{$remote};
 
             $conf->write();
diff --git a/src/PMG/PBSConfig.pm b/src/PMG/PBSConfig.pm
index 8498893c..4ceb81a3 100644
--- a/src/PMG/PBSConfig.pm
+++ b/src/PMG/PBSConfig.pm
@@ -125,6 +125,11 @@ sub properties {
             type => 'boolean',
             optional => 1,
         },
+        'encryption-key' => {
+            description =>
+                "Encryption key. Use 'autogen' to generate one automatically without passphrase.",
+            type => 'string',
+        },
         %prune_properties,
     };
 }
@@ -147,6 +152,7 @@ sub options {
         'keep-weekly' => { optional => 1 },
         'keep-monthly' => { optional => 1 },
         'keep-yearly' => { optional => 1 },
+        'encryption-key' => { optional => 1 },
     };
 }
 
-- 
2.47.3