GPG encryption

Dockerfile

@@ -13,7 +13,7 @@ COPY scripts/*.sh /app/
 
 RUN chmod +x /app/*.sh \
   && mkdir -m 777 /bitwarden \
-  && apk add --no-cache 7zip bash mariadb-client postgresql15-client sqlite supercronic s-nail tzdata \
+  && apk add --no-cache 7zip bash mariadb-client postgresql15-client sqlite supercronic s-nail tzdata gpg \
   && apk info --no-cache -Lq mariadb-client | grep -vE '/bin/mariadb$' | grep -vE '/bin/mariadb-dump$' | xargs -I {} rm -f "/{}" \
   && ln -sf "${LOCALTIME_FILE}" /etc/localtime \
   && addgroup -g "${USER_ID}" "${USER_NAME}" \

docker-compose.yml

@@ -22,10 +22,18 @@ services:
     #   RCLONE_GLOBAL_FLAG: ''
     #   CRON: '5 * * * *'
     #   ZIP_ENABLE: 'TRUE'
-    #   ZIP_PASSWORD: 'WHEREISMYPASSWORD?'
+    #   ZIP_PASSWORD: ''
     #   ZIP_TYPE: 'zip'
     #   BACKUP_FILE_SUFFIX: '%Y%m%d'
     #   BACKUP_KEEP_DAYS: 0
+    #   GPG_ENABLE: 'FALSE'
+    #   GPG_PUBKEY: |
+    #     -----BEGIN PGP PUBLIC KEY BLOCK-----
+    #
+    #     mQINBGU+LVgBEADSxdHNywMJWt7q/K4EcvQhA6A0CNANN18BLTelcTZBJheNqz1I
+    #     tRq9pW6VBsJTpYWXTz0satGB3XLyhd9rUe1Ydz6zSbewh66vUdh6CaJI5Hr8TSur
+    #     ...
+    #     -----END PGP PUBLIC KEY BLOCK-----
     #   PING_URL: ''
     #   MAIL_SMTP_ENABLE: 'FALSE'
     #   MAIL_SMTP_VARIABLES: ''

scripts/backup.sh

@@ -4,6 +4,7 @@
 
 function clear_dir() {
     rm -rf "${BACKUP_DIR}"
+    rm -rf "${GPG_DIR}"
 }
 
 function backup_init() {
@@ -141,9 +142,17 @@ function backup_package() {
         UPLOAD_FILE="${BACKUP_FILE_ZIP}"
 
         if [[ "${ZIP_TYPE}" == "zip" ]]; then
-            7z a -tzip -mx=9 -p"${ZIP_PASSWORD}" "${BACKUP_FILE_ZIP}" "${BACKUP_DIR}"/*
+            if [[ -n "${ZIP_PASSWORD}" ]]; then
+                7z a -tzip -mx=9 -p"${ZIP_PASSWORD}" "${BACKUP_FILE_ZIP}" "${BACKUP_DIR}"/*
+            else
+                7z a -tzip -mx=9 "${BACKUP_FILE_ZIP}" "${BACKUP_DIR}"/*
+            fi
         else
-            7z a -t7z -m0=lzma2 -mx=9 -mfb=64 -md=32m -ms=on -mhe=on -p"${ZIP_PASSWORD}" "${BACKUP_FILE_ZIP}" "${BACKUP_DIR}"/*
+            if [[ -n "${ZIP_PASSWORD}" ]]; then
+                7z a -t7z -m0=lzma2 -mx=9 -mfb=64 -md=32m -ms=on -mhe=on -p"${ZIP_PASSWORD}" "${BACKUP_FILE_ZIP}" "${BACKUP_DIR}"/*
+            else
+                7z a -t7z -m0=lzma2 -mx=9 -mfb=64 -md=32m -ms=on -mhe=on "${BACKUP_FILE_ZIP}" "${BACKUP_DIR}"/*
+            fi
         fi
 
         ls -lah "${BACKUP_DIR}"
@@ -158,6 +167,30 @@ function backup_package() {
     fi
 }
 
+function backup_gpg() {
+    if [[ "${GPG_ENABLE}" == "TRUE" ]]; then
+        color blue "encrypt backup file"
+
+        echo "${GPG_PUBKEY}" > /config/key.pub
+
+        if [[ -f "${UPLOAD_FILE}" ]]; then
+            gpg --quiet --output "${BACKUP_FILE_ZIP}.gpg" --encrypt --recipient-file /config/key.pub "${UPLOAD_FILE}"
+
+            UPLOAD_FILE="${BACKUP_FILE_ZIP}.gpg"
+        else
+            mkdir -p "${GPG_DIR}"
+
+            find "${UPLOAD_FILE}" -maxdepth 1 -type f -print0 | while IFS= read -r -d '' FILEPATH; do
+                local FILENAME=$(basename "${FILEPATH}")
+
+                gpg --quiet --output "${GPG_DIR}/${FILENAME}.gpg" --encrypt --recipient-file /config/key.pub "${FILEPATH}"
+            done
+
+            UPLOAD_FILE="${GPG_DIR}"
+        fi
+    fi
+}
+
 function upload() {
     # upload file not exist
     if [[ ! -e "${UPLOAD_FILE}" ]]; then
@@ -220,6 +253,7 @@ clear_dir
 backup_init
 backup
 backup_package
+backup_gpg
 upload
 clear_dir
 clear_history

scripts/includes.sh

@@ -3,6 +3,7 @@
 ENV_FILE="/.env"
 CRON_CONFIG_FILE="${HOME}/crontabs"
 BACKUP_DIR="/bitwarden/backup"
+GPG_DIR="/bitwarden/gpg"
 RESTORE_DIR="/bitwarden/restore"
 RESTORE_EXTRACT_DIR="/bitwarden/extract"
 
@@ -81,6 +82,22 @@ function check_dir_exist() {
     fi
 }
 
+########################################
+# Check GPG key is exist.
+# Arguments:
+#     public key content
+########################################
+function check_gpg_key_exist() {
+    echo "${GPG_PUBKEY}" > /config/key.pub
+
+    local output
+    output=$(gpg /config/key.pub 2>&1)
+    if [[ ! $output == *"pub"* ]]; then
+        color red "cannot access GPG key: No valid public key"
+        exit 1
+    fi
+}
+
 ########################################
 # Send mail by s-nail.
 # Arguments:
@@ -284,7 +301,7 @@ function init_env() {
 
     # ZIP_PASSWORD
     get_env ZIP_PASSWORD
-    ZIP_PASSWORD="${ZIP_PASSWORD:-"WHEREISMYPASSWORD?"}"
+    ZIP_PASSWORD="${ZIP_PASSWORD:-""}"
 
     # ZIP_TYPE
     get_env ZIP_TYPE
@@ -295,6 +312,19 @@ function init_env() {
         ZIP_TYPE="zip"
     fi
 
+    # GPG_ENABLE
+    get_env GPG_ENABLE
+    GPG_ENABLE=$(echo "${GPG_ENABLE}" | tr '[a-z]' '[A-Z]')
+    if [[ "${GPG_ENABLE}" == "FALSE" ]]; then
+        GPG_ENABLE="FALSE"
+    else
+        GPG_ENABLE="TRUE"
+    fi
+
+    # GPG_PUBKEY
+    get_env GPG_PUBKEY
+    if [[ "${GPG_ENABLE}" == "TRUE" ]]; then check_gpg_key_exist "${GPG_PUBKEY}"; fi
+
     # BACKUP_KEEP_DAYS
     get_env BACKUP_KEEP_DAYS
     BACKUP_KEEP_DAYS="${BACKUP_KEEP_DAYS:-"0"}"
@@ -346,6 +376,8 @@ function init_env() {
     color yellow "ZIP_ENABLE: ${ZIP_ENABLE}"
     color yellow "ZIP_PASSWORD: ${#ZIP_PASSWORD} Chars"
     color yellow "ZIP_TYPE: ${ZIP_TYPE}"
+    color yellow "GPG_ENABLE: ${GPG_ENABLE}"
+    color yellow "GPG_PUBKEY: ${GPG_PUBKEY}"
     color yellow "BACKUP_FILE_DATE_FORMAT: ${BACKUP_FILE_DATE_FORMAT} (example \"[filename].$(date +"${BACKUP_FILE_DATE_FORMAT}").[ext]\")"
     color yellow "BACKUP_KEEP_DAYS: ${BACKUP_KEEP_DAYS}"
     if [[ -n "${PING_URL}" ]]; then