Encrypted Backups

Rescue Missions restore encrypted backups too. For that, our platform needs your PBS encryption key while the run lasts. This guide shows how to hand it over and what happens to it.

Prepare the key file

Use the PBS key file (JSON) of the backups. Proxmox VE cannot use a key that has a passphrase, so remove the passphrase from a copy of the file:

cp key.json key-nopass.json
proxmox-backup-client key change-passphrase --kdf none key-nopass.json

Unlock the guests

In the mission, encrypted guests show the key status Locked. Open one of them and paste or load the key file. An option applies the same key to all other locked guests of the mission. The key must belong to the snapshot: when its fingerprint does not match, the run does not start.

Until you start a run, the key only lives in your browser tab, and the browser forgets it when you leave the mission page. During the run, we put it into the restore storage on our platform and delete it together with that storage when the run ends. By default, we never write it to our database.

Store a key for unattended runs

Scheduled tests and failovers that start without you need the key as well. To allow them, store it with the mission: open the menu ⋮, select Test schedule and add the key there. A stored key stays encrypted in our database until you remove it. The dashboard only shows which guests have a stored key and its fingerprint, never the key itself.