cloudstic

package module
v1.18.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Aug 2, 2026 License: MIT Imports: 16 Imported by: 0

README

Cloudstic CLI

CI codecov Release License Go Version

Content-addressable, encrypted backup tool for Google Drive, OneDrive, and local files.

Features

  • Encrypted by default: AES-256-GCM encryption with password, platform key, or recovery key slots
  • Content-addressable storage: Deduplication across sources; identical files stored only once
  • Incremental backups: Only changed files are stored
  • Multiple sources: Google Drive, Google Drive Changes API, OneDrive, local directories
  • Multiple backends: Local filesystem, Amazon S3 (and compatibles like R2, MinIO), or Backblaze B2
  • Retention policies: Keep-last, hourly, daily, weekly, monthly, yearly
  • Portable drive awareness: Automatically identifies USB drives and external disks by GPT partition UUID — back up the same drive from any machine or mount point, across macOS, Linux, and Windows
  • Point-in-time restore: Restore any snapshot, any file, any time

Supported Sources

Source Flag Description
Local directory -source local Back up any local folder (auto-detects portable drives)
Google Drive -source gdrive Full rescan of My Drive or a Shared Drive
Google Drive (Changes) -source gdrive-changes Recommended. Fast incremental backup via the Changes API
OneDrive -source onedrive Full scan of a Microsoft OneDrive account
OneDrive (Changes) -source onedrive-changes Recommended. Fast incremental backup via the Delta API

Google Drive and OneDrive work out of the box. On first run, Cloudstic opens your browser for authorization and caches the token locally. See the User Guide — Sources for details.

Install

brew install cloudstic/tap/cloudstic   # macOS / Linux
winget install Cloudstic.CLI           # Windows
go install github.com/cloudstic/cli/cmd/cloudstic@latest  # with Go

# Curl installer (macOS / Linux)
curl -fsSL https://raw.githubusercontent.com/Cloudstic/cli/main/scripts/install.sh | sh

# Install with shell completion
curl -fsSL https://raw.githubusercontent.com/Cloudstic/cli/main/scripts/install.sh | sh -s -- --with-completion

Or download a binary from Releases. See the User Guide for all options.

Quick Start

# Initialize an encrypted repository (prompts for password interactively)
cloudstic init

# Back up a local directory (prompts for password if not set via flag or env)
cloudstic backup -source local:~/Documents

# Back up Google Drive (opens browser for auth on first run)
cloudstic backup -source gdrive-changes

# Back up a USB drive (auto-detected by partition UUID)
cloudstic backup -source local:/Volumes/MyUSB

# List snapshots
cloudstic list

# Find a file across every snapshot, without knowing which one holds it
cloudstic find "vault.kdbx"

# Restore latest snapshot to a zip file
cloudstic restore

# Preview what a backup would do (dry run)
cloudstic backup -source local:~/Documents -dry-run

# Discover local source candidates and portable drives
cloudstic source discover -portable-only

# Preview a workstation onboarding plan
cloudstic setup workstation -dry-run

# Launch the interactive dashboard for configured profiles
cloudstic tui

Profiles

Save your backup configuration once and reuse it:

# Create a store (interactive — prompts for encryption setup)
cloudstic store new -name my-s3 -uri s3:my-bucket/backups -s3-region us-east-1

# Create a profile
cloudstic profile new -name documents -source local:~/Documents -store-ref my-s3

# Now backups are one command
cloudstic backup -profile documents

# Or back up all profiles at once
cloudstic backup -all-profiles

See the User Guide — Profiles for details.

When running interactively, Cloudstic prompts for the repository password if no credential is provided via flags or environment variables. For non-interactive use (scripts, cron), pass -password or set CLOUDSTIC_PASSWORD:

cloudstic init -password "my passphrase"
cloudstic backup -source local:~/Documents -password "my passphrase"

Portable Drive Backup

Cloudstic automatically detects when a source path is on a portable drive (USB stick, external SSD, SD card). It identifies the drive by its GPT partition UUID and stores paths relative to the volume root, so backups are consistent regardless of where the drive is mounted or which OS you use.

# On macOS — drive mounts at /Volumes/MyUSB
cloudstic backup -source local:/Volumes/MyUSB

# On Linux — same drive mounts at /mnt/usb
cloudstic backup -source local:/mnt/usb

# Both produce identical snapshots with the same source identity
cloudstic list

This works automatically on GPT-formatted drives (exFAT, APFS, ext4, NTFS). For older MBR-formatted drives, pass -volume-uuid explicitly. See the User Guide for details.

Performance

Benchmarked against Restic, Borg, and Duplicacy on a ~1 GB dataset (local) and a real Google Drive account (~40 MB). Full methodology and numbers in docs/benchmark-results.md.

Local filesystem (time / peak RAM):

Operation Cloudstic Restic Borg Duplicacy
Initial backup 0.61s / 259 MB 1.80s / 314 MB 1.69s / 139 MB 3.44s / 284 MB
Incremental (no changes) 0.05s / 96 MB 0.77s / 72 MB 0.67s / 72 MB 0.04s / 44 MB
Add 200 MB new data 0.14s / 152 MB 1.07s / 283 MB 0.57s / 136 MB 0.93s / 195 MB

Google Drive — each step run stateless (no rclone cache) to reflect real-world cold-start conditions:

Operation Cloudstic Restic Borg
Initial backup 6.08s 11.14s 15.06s
Incremental (no changes) 0.56s 14.70s 25.49s

Cloudstic uses the Google Drive Changes API natively — incremental backups only fetch what actually changed, no full re-scan required. Restic and Borg rely on rclone FUSE mounts and must re-download the entire dataset to detect changes.

Documentation

Full documentation is available at docs.cloudstic.com.

This repository also contains developer-focused reference docs:

  • User Guide: commands, setup, encryption, retention policies
  • Source API: source interface, implementations, and how to add a new source
  • Specification: object types, backup/restore flow, HAMT structure
  • Encryption: key slot design, AES-256-GCM, recovery keys
  • Storage Model: content-addressable storage layout
  • Contributing: testing, profiling, debugging

Cloud Service

Don't want to manage infrastructure? Cloudstic Cloud handles scheduling, storage, and retention automatically. Same engine, zero ops.

License

MIT

Documentation

Index

Constants

View Source 
const (
	FileTypeFile   = core.FileTypeFile
	FileTypeFolder = core.FileTypeFolder
)

FileType values.

View Source 
const (
	DetailNormal  = ui.DetailNormal
	DetailVerbose = ui.DetailVerbose
)

The detail levels a Reporter chooses between.

View Source 
const (
	SecretRefInvalid            = secretref.KindInvalidRef
	SecretRefNotFound           = secretref.KindNotFound
	SecretRefBackendUnavailable = secretref.KindBackendUnavailable
)
View Source 
const (
	SizeAtLeast = engine.SizeAtLeast
	SizeAtMost  = engine.SizeAtMost
	SizeExactly = engine.SizeExactly
)
View Source 
const (
	ChangeAdded    = engine.ChangeAdded
	ChangeRemoved  = engine.ChangeRemoved
	ChangeModified = engine.ChangeModified
)

Variables

View Source 
var (
	WithBackupDryRun        = engine.WithBackupDryRun
	WithIgnoreEmptySnapshot = engine.WithIgnoreEmptySnapshot
	WithTags                = engine.WithTags
	WithGenerator           = engine.WithGenerator
	WithMeta                = engine.WithMeta
	WithExcludeHash         = engine.WithExcludeHash
)
View Source 
var (
	WithReadData    = engine.WithReadData
	WithSnapshotRef = engine.WithSnapshotRef
)
View Source 
var (
	ParseSizeCompare = engine.ParseSizeCompare
	ParseFindTime    = engine.ParseFindTime
)
View Source 
var (
	WithInitCredentials  = engine.WithInitCredentials
	WithInitRecovery     = engine.WithInitRecovery
	WithInitNoEncryption = engine.WithInitNoEncryption
	WithInitAdoptSlots   = engine.WithInitAdoptSlots
)
View Source 
var (
	// ErrSnapshotNotFound means no snapshot matched a requested reference.
	ErrSnapshotNotFound = engine.ErrSnapshotNotFound
	// ErrSnapshotRefAmbiguous means more than one snapshot matched a hash prefix.
	ErrSnapshotRefAmbiguous = engine.ErrSnapshotRefAmbiguous

	WithRestoreDryRun   = engine.WithRestoreDryRun
	WithRestorePath     = engine.WithRestorePath
	WithRestoreNoVerify = engine.WithRestoreNoVerify
)
View Source 
var (
	WithPrune         = engine.WithPrune
	WithDryRun        = engine.WithDryRun
	WithKeepLast      = engine.WithKeepLast
	WithKeepHourly    = engine.WithKeepHourly
	WithKeepDaily     = engine.WithKeepDaily
	WithKeepWeekly    = engine.WithKeepWeekly
	WithKeepMonthly   = engine.WithKeepMonthly
	WithKeepYearly    = engine.WithKeepYearly
	WithGroupBy       = engine.WithGroupBy
	WithFilterTag     = engine.WithFilterTag
	WithFilterSource  = engine.WithFilterSource
	WithFilterAccount = engine.WithFilterAccount
	WithFilterPath    = engine.WithFilterPath
)
View Source 
var ErrPlaintextObject = storelayer.ErrPlaintextObject

ErrPlaintextObject reports that an encrypted repository contains an object that is not ciphertext. Use errors.Is(err, ErrPlaintextObject) to tell this apart from a decryption failure: the object was never encrypted, rather than encrypted with a key you do not hold.

View Source 
var ErrRepoLocked = engine.ErrRepoLocked

ErrRepoLocked means Backup, Restore, or Prune could not proceed because the repository is held by another operation. Use errors.Is(err, ErrRepoLocked) to detect the condition and prompt the caller toward BreakLock.

View Source 
var (
	WithPruneDryRun = engine.WithPruneDryRun
)

Functions

func AddRecoveryKey added in v1.7.0 

func AddRecoveryKey(ctx context.Context, rawStore store.ObjectStore, kc keychain.Chain, opts AddRecoveryKeyOptions) (string, error)

AddRecoveryKey generates a BIP39 recovery key for the repository, authenticating with kc to obtain the master key. Returns the 24-word mnemonic phrase.

If a recovery slot with the requested label already exists and opts.Replace is false, it returns a *keychain.SlotExistsError and writes nothing.

func ChangePassword added in v1.7.0 

func ChangePassword(ctx context.Context, rawStore store.ObjectStore, kc keychain.Chain, pwd PasswordProvider) error

ChangePassword replaces the password key slot using the provided keychain to authenticate and newPassword as the new passphrase.

func UpgradeRepoFormat added in v1.16.0 

func UpgradeRepoFormat(
	ctx context.Context,
	rawStore store.ObjectStore,
	to int,
	encryptionKey []byte,
) error

UpgradeRepoFormat raises a repository's recorded format version to `to`, leaving it alone if it already meets or exceeds that.

Repositories are upgraded in place and partially: new structures are written in the current format while older ones are read as they are and rewritten only opportunistically. A repository is therefore a permanent mixture of eras, and its recorded version is not a claim that migration finished. It is the *minimum reader version*: the oldest build that can still read everything the repository now contains.

Call this from the write path that first stores something an older build would misread — at the moment of that write, not on mere access. Stamping a repository just because a newer binary opened it would lock older builds out of data they can still read correctly, which is the same harm the version gate exists to prevent.

A mutation calls it — never a read — so a repository written by this build tells other machines sharing it to upgrade. When it stamps relative to the write depends on the mutation: prune and forget stamp afterwards (best-effort, via Client.stampWriteFormat), because what they write is decoded correctly at either format; backup stamps beforehand (fatal, via Client.raiseRepoFormat), because it writes content whose encoding an older build would misread and which cannot be rewritten once stored. See core.FramedCompressionFormat and docs/compatibility.md.

encryptionKey is required for an encrypted repository, whose marker is sealed: the version lives inside the sealed blob, so raising it means unsealing and resealing. Pass nil for an unencrypted repository.

Types

type AddRecoveryKeyOptions added in v1.16.0 

type AddRecoveryKeyOptions struct {
	// Label names the slot (object key keys/recovery-<label>). Empty means the
	// default slot. Distinct labels let a repository hold several recovery keys,
	// all of which stay valid.
	Label string
	// Replace permits overwriting an existing slot with the same label, which
	// invalidates the mnemonic that slot was issued for.
	Replace bool
}

AddRecoveryKeyOptions controls which recovery slot AddRecoveryKey writes.

type BackupOption 

type BackupOption = engine.BackupOption

type BackupResult added in v1.2.0 

type BackupResult = engine.RunResult

type CatResult added in v1.4.6 

type CatResult struct {
	Key  string // The object key requested
	Data []byte // Raw object data (typically JSON)
}

CatResult contains the raw data for an object key.

type ChangeType added in v1.18.0 

type ChangeType = engine.ChangeType

ChangeType describes the kind of change a FileChange represents.

type CheckError added in v1.4.7 

type CheckError = engine.CheckError

type CheckOption added in v1.4.7 

type CheckOption = engine.CheckOption

type CheckResult added in v1.4.7 

type CheckResult = engine.CheckResult

type Client 

type Client struct {
	// contains filtered or unexported fields
}

Client is the high-level interface for using Cloudstic as a library.

func NewClient 

func NewClient(ctx context.Context, base store.ObjectStore, opts ...ClientOption) (*Client, error)

func (*Client) Backup 

func (c *Client) Backup(ctx context.Context, src source.Source, opts ...BackupOption) (*BackupResult, error)

func (*Client) BreakLock added in v1.3.0 

func (c *Client) BreakLock(ctx context.Context) ([]*RepoLock, error)

func (*Client) Cat added in v1.4.6 

func (c *Client) Cat(ctx context.Context, keys ...string) ([]*CatResult, error)

Cat fetches the raw data for one or more object keys from the repository. Object keys can be snapshot/<hash>, filemeta/<hash>, content/<hash>, node/<hash>, chunk/<hash>, config, index/latest, keys/<slot>, etc.

This is useful for debugging, inspection, and understanding the internal structure of the repository.

func (*Client) Check added in v1.4.7 

func (c *Client) Check(ctx context.Context, opts ...CheckOption) (*CheckResult, error)

Check verifies the integrity of the repository by walking the full reference chain (snapshots → HAMT nodes → filemeta → content → chunks) and checking that every referenced object can be read. With WithReadData(), chunk data is re-hashed for byte-level verification.

func (*Client) Diff 

func (c *Client) Diff(ctx context.Context, snap1, snap2 string, opts ...DiffOption) (*DiffResult, error)

Diff compares snapshots selected by latest, full hashes, or unambiguous hash prefixes. An ambiguous prefix is rejected.

func (*Client) Find added in v1.17.0 

func (c *Client) Find(ctx context.Context, q FindQuery) (*FindResult, error)

Find locates files across the repository's snapshots without the caller having to know which snapshot holds them.

Unlike every other read operation, Find takes a snapshot as *output* rather than input: it searches every snapshot by default, and reports for each matching file the versions it has had and the snapshots each version lives in.

It is a pure read path — no lock is taken, nothing is written, and the repository format is not stamped.

The query is a value rather than a list of options because it already was one: FindQuery is JSON-tagged and grouped into predicates, snapshot selectors and presentation, so twenty-one option constructors existed only to set its fields one at a time. Building it directly also makes a query serializable — storable, loggable, sendable — which a closure over a private struct is not. Use FindQuery.SetPattern for a positional pattern, which routes by shape.

func (*Client) Forget 

func (c *Client) Forget(ctx context.Context, snapshotID string, opts ...ForgetOption) (*ForgetResult, error)

func (*Client) ForgetPolicy 

func (c *Client) ForgetPolicy(ctx context.Context, opts ...ForgetOption) (*PolicyResult, error)

func (*Client) List 

func (c *Client) List(ctx context.Context, opts ...ListOption) (*ListResult, error)

func (*Client) LsSnapshot 

func (c *Client) LsSnapshot(ctx context.Context, snapshotID string, opts ...LsSnapshotOption) (*LsSnapshotResult, error)

LsSnapshot lists a snapshot selected by latest, full hash, or unambiguous hash prefix. An ambiguous prefix is rejected.

func (*Client) Prune 

func (c *Client) Prune(ctx context.Context, opts ...PruneOption) (*PruneResult, error)

func (*Client) Restore 

func (c *Client) Restore(ctx context.Context, w io.Writer, snapshotRef string, opts ...RestoreOption) (*RestoreResult, error)

Restore writes the snapshot's file tree as a ZIP archive to w. snapshotRef can be "", "latest", a bare hash or unambiguous hash prefix, or "snapshot/<hash-or-prefix>". An ambiguous prefix is rejected.

func (*Client) RestoreToDir added in v1.12.0 

func (c *Client) RestoreToDir(ctx context.Context, outputDir, snapshotRef string, opts ...RestoreOption) (*RestoreResult, error)

RestoreToDir writes the snapshot's file tree directly into outputDir. snapshotRef can be "", "latest", a bare hash or unambiguous hash prefix, or "snapshot/<hash-or-prefix>". An ambiguous prefix is rejected.

func (*Client) Store added in v1.1.0 

func (c *Client) Store() store.ObjectStore

type ClientOption 

type ClientOption func(*Client)

ClientOption configures a Client.

func WithEncryptionKey added in v1.1.0 

func WithEncryptionKey(key []byte) ClientOption

WithEncryptionKey directly sets the AES-256-GCM encryption key (32 bytes). This bypasses repo config detection and unconditionally applies encryption. The HMAC deduplication key is automatically derived from this key. Use this for the SaaS product where the key is already resolved externally.

func WithKeychain added in v1.9.0 

func WithKeychain(kc keychain.Chain) ClientOption

WithKeychain sets a Keychain for automatic master key resolution. During NewClient, the repo config is read from the store; if the repository is encrypted, Resolve is called to obtain the master key and the encryption key is derived. If the repository is not encrypted, the keychain is silently ignored.

func WithLogger added in v1.18.0 

func WithLogger(w io.Writer) ClientOption

WithLogger sends this client's debug output to w, along with that of the engine and store layers it drives.

Debug output was previously reachable only by setting a package-level writer inside the module, so a library caller could not turn it on at all. A sink given here belongs to this client alone: two clients in one process can log to different places, or one can log while the other stays silent (RFC 0022 §8).

func WithPackfile added in v1.4.3 

func WithPackfile(enable bool) ClientOption

WithPackfile enables bundling small objects into 8MB packs to save API calls.

func WithReporter 

func WithReporter(r Reporter) ClientOption

WithReporter sets the progress reporter for the client.

type Detail added in v1.18.0 

type Detail = ui.Detail

Detail is how much an operation should report. It reaches the public API through Phase.Logf, so a caller implementing Reporter can decide what to show.

type DiffOption 

type DiffOption = engine.DiffOption

type DiffResult 

type DiffResult = engine.DiffResult

type FileChange added in v1.18.0 

type FileChange = engine.FileChange

FileChange is one change reported by Diff, between two snapshots.

type FileMatch added in v1.17.0 

type FileMatch = engine.FileMatch

type FileMeta added in v1.18.0 

type FileMeta = core.FileMeta

FileMeta represents immutable file metadata, as referenced by pkg/source.Source implementations and by result types such as FileMatch and LsSnapshotResult.

type FileType added in v1.18.0 

type FileType = core.FileType

FileType is the generic type of a file (file or folder).

type FileVersion added in v1.17.0 

type FileVersion = engine.FileVersion

type FindQuery added in v1.17.0 

type FindQuery = engine.FindQuery

type FindResult added in v1.17.0 

type FindResult = engine.FindResult

type ForgetOption 

type ForgetOption = engine.ForgetOption

type ForgetResult added in v1.2.0 

type ForgetResult = engine.ForgetResult

type GroupKey added in v1.18.0 

type GroupKey = engine.GroupKey

GroupKey identifies a group of snapshots for policy application.

type InitOption added in v1.7.0 

type InitOption = engine.InitOption

type InitResult added in v1.7.0 

type InitResult = engine.InitResult

func InitRepo added in v1.7.0 

func InitRepo(ctx context.Context, rawStore store.ObjectStore, opts ...InitOption) (*InitResult, error)

InitRepo bootstraps a new repository on the given raw (undecorated) store. This is a package-level function because init runs before the full Client decorator chain (encryption, compression, packfiles) is set up.

type KMSClient added in v1.9.0 

type KMSClient = crypto.KMSClient

KMSClient is re-exported for callers that provide KMS credentials.

type KeepReason added in v1.18.0 

type KeepReason = engine.KeepReason

KeepReason pairs a snapshot with the reasons it was kept.

type KeySlot added in v1.4.6 

type KeySlot = keychain.KeySlot

KeySlot is re-exported for callers that need to inspect slot metadata.

func ListKeySlots added in v1.7.0 

func ListKeySlots(ctx context.Context, rawStore store.ObjectStore) ([]KeySlot, error)

ListKeySlots returns all encryption key slots in the repository. Returns an error if the repository is not initialized or not encrypted.

type ListOption 

type ListOption = engine.ListOption

type ListResult 

type ListResult = engine.ListResult

type LsSnapshotOption 

type LsSnapshotOption = engine.LsSnapshotOption

type LsSnapshotResult 

type LsSnapshotResult = engine.LsSnapshotResult

type PasswordProvider added in v1.7.0 

type PasswordProvider interface {
	NewPassword(ctx context.Context) (string, error)
}

PasswordProvider supplies a new password when prompted. It is used by ChangePassword to obtain the replacement passphrase. Implementations may prompt the user interactively, derive a password programmatically, or return a static value.

type PasswordProviderFunc added in v1.7.0 

type PasswordProviderFunc func(ctx context.Context) (string, error)

PasswordProviderFunc is a function adapter for PasswordProvider. Any func(context.Context) (string, error) can be used as a PasswordProvider: 

client.ChangePassword(ctx, store, creds, cloudstic.PasswordProviderFunc(func(ctx context.Context) (string, error) {
	return promptUser("New password: ")
}))

func (PasswordProviderFunc) NewPassword added in v1.7.0 

func (f PasswordProviderFunc) NewPassword(ctx context.Context) (string, error)

type PasswordString added in v1.7.0 

type PasswordString string

PasswordString is a PasswordProvider that returns a fixed string. Use this when the new password is already known at call time: 

client.ChangePassword(ctx, store, creds, cloudstic.PasswordString("my-new-password"))

func (PasswordString) NewPassword added in v1.7.0 

func (p PasswordString) NewPassword(ctx context.Context) (string, error)

type Phase added in v1.2.0 

type Phase = ui.Phase

Phase represents an active progress tracking phase.

type PolicyGroupResult added in v1.18.0 

type PolicyGroupResult = engine.PolicyGroupResult

PolicyGroupResult holds the policy evaluation result for a single group of snapshots, as returned in PolicyResult.Groups.

type PolicyResult 

type PolicyResult = engine.PolicyResult

type PruneOption 

type PruneOption = engine.PruneOption

type PruneResult added in v1.2.0 

type PruneResult = engine.PruneResult

type RepoConfig added in v1.2.0 

type RepoConfig = core.RepoConfig

RepoConfig is the repository marker written by "init".

func LoadRepoConfig added in v1.7.0 

func LoadRepoConfig(
	ctx context.Context,
	rawStore store.ObjectStore,
	encryptionKey []byte,
) (*RepoConfig, error)

LoadRepoConfig reads the repository marker from a raw (undecorated) store. Returns (nil, nil) if the repository has not been initialized yet. Returns an error if the store is unreachable (e.g. invalid credentials).

encryptionKey is required when the marker is sealed and ignored otherwise. Callers that only need to know whether a repository is initialized or encrypted should use InspectRepo, which needs no key.

type RepoLock added in v1.3.0 

type RepoLock = engine.RepoLock

type RepoStatus added in v1.17.0 

type RepoStatus struct {
	// Initialized reports whether a config marker exists at all.
	Initialized bool
	// Encrypted reports whether the repository uses encryption. A sealed marker
	// answers this on its own: only an encrypted repository has a key to seal
	// with.
	Encrypted bool
	// Sealed reports whether the marker itself is sealed. An encrypted
	// repository written before sealing existed is Encrypted but not Sealed.
	Sealed bool
}

RepoStatus is what can be determined about a repository without resolving its encryption key.

func InspectRepo added in v1.17.0 

func InspectRepo(ctx context.Context, rawStore store.ObjectStore) (RepoStatus, error)

InspectRepo reports what can be learned about a repository without its key.

This exists for callers that only need to know whether a repository is initialized or encrypted — deciding whether to prompt for credentials, for instance — which sealing would otherwise make impossible to answer without first doing the very unlock the caller is trying to decide about.

type Reporter added in v1.2.0 

type Reporter = ui.Reporter

Reporter defines the interface for progress reporting.

type RestoreOption 

type RestoreOption = engine.RestoreOption

type RestoreResult 

type RestoreResult = engine.RestoreResult

type SecretRef added in v1.18.0 

type SecretRef = secretref.Ref

SecretRef is a parsed scheme://path secret reference.

type SecretRefError added in v1.18.0 

type SecretRefError = secretref.Error

SecretRefError reports a malformed scheme://path secret reference (e.g. in one of a profile's *_secret fields). Use errors.As to inspect it and Kind to branch on the failure mode.

type SecretRefErrorKind added in v1.18.0 

type SecretRefErrorKind = secretref.ErrorKind

SecretRefErrorKind categorizes a SecretRefError.

type SecretResolver added in v1.18.0 

type SecretResolver = secretref.Resolver

SecretResolver resolves a scheme://path secret reference to its value, as accepted by pkg/source/onedrive.WithResolver and pkg/source/gdrive.WithResolver.

type SizeCompare added in v1.17.0 

type SizeCompare = engine.SizeCompare

type SizeOp added in v1.17.0 

type SizeOp = engine.SizeOp

type Snapshot added in v1.18.0 

type Snapshot = core.Snapshot

Snapshot represents a backup checkpoint, as referenced by LsSnapshotResult.

type SnapshotEntry added in v1.18.0 

type SnapshotEntry = engine.SnapshotEntry

SnapshotEntry is a snapshot loaded for policy evaluation, as referenced by KeepReason and by ListResult.Snapshots.

type SnapshotRef added in v1.17.0 

type SnapshotRef = engine.SnapshotRef

type SourceInfo added in v1.18.0 

type SourceInfo = core.SourceInfo

SourceInfo describes the origin of a backup snapshot, as referenced by pkg/source.Source.Info and by result types such as FileMatch.

type WritableSecretBackend added in v1.18.0 

type WritableSecretBackend = secretref.WritableBackend

WritableSecretBackend is a secret backend that supports writing new values, as returned by SecretResolver.WritableBackends.

Source Files

View all Source files

Directories

Path Synopsis
cmd
cloudstic command
Store encryption configuration: choosing a method for a store and recording where its secrets live.
 Store encryption configuration: choosing a method for a store and recording where its secrets live.
internal
apicheck
Package apicheck holds repository-hygiene tests that inspect the module rather than exercise it: the public API boundary (RFC 0022) and the goreleaser ldflags wiring.
 Package apicheck holds repository-hygiene tests that inspect the module rather than exercise it: the public API boundary (RFC 0022) and the goreleaser ldflags wiring.
app
core
engine
hamt
logger
Package logger provides the component-prefixed debug output that the client, engine, source, and store layers write when debugging is enabled.
 Package logger provides the component-prefixed debug output that the client, engine, source, and store layers write when debugging is enabled.
pathmatch
Package pathmatch matches slash-separated paths against glob patterns.
 Package pathmatch matches slash-separated paths against glob patterns.
paths
repoconfig
Package repoconfig encodes and decodes the repository config marker.
 Package repoconfig encodes and decodes the repository config marker.
retry
sftp
sourceoauth
Package sourceoauth holds the OAuth2 machinery shared by the Google Drive and OneDrive sources: the local-callback authorization-code flow and a token source that persists refreshed tokens.
 Package sourceoauth holds the OAuth2 machinery shared by the Google Drive and OneDrive sources: the local-callback authorization-code flow and a token source that persists refreshed tokens.
storelayer
tui
tui/forms
Package forms provides Bubble Tea form components for the interactive TUI.
 Package forms provides Bubble Tea form components for the interactive TUI.
ui
workstation
pkg
config
Package config holds the resolved configuration for opening a Cloudstic repository: which store to talk to, which credentials unlock it, and how the client should behave.
 Package config holds the resolved configuration for opening a Cloudstic repository: which store to talk to, which credentials unlock it, and how the client should behave.
crypto
Package crypto provides authenticated encryption primitives for backup data.
 Package crypto provides authenticated encryption primitives for backup data.
crypto/kms
Package kms implements crypto.KMSClient on top of the AWS KMS SDK.
 Package kms implements crypto.KMSClient on top of the AWS KMS SDK.
keychain
keychain/kms
Package kms provides the AWS-backed keychain credential.
 Package kms provides the AWS-backed keychain credential.
open
Package open constructs live objects from resolved configuration: an object store from a store URI and its credentials, a keychain from a set of unlock credentials, and a repository client from both.
 Package open constructs live objects from resolved configuration: an object store from a store URI and its credentials, a keychain from a set of unlock credentials, and a repository client from both.
profile
secretref
secretref/backends
Package backends holds the secret backends Cloudstic ships with, split out from the pkg/secretref contract so that implementing a custom backend does not drag in the platform-native ones (macOS Keychain, libsecret, Windows Credential Manager) and their build constraints.
 Package backends holds the secret backends Cloudstic ships with, split out from the pkg/secretref contract so that implementing a custom backend does not drag in the platform-native ones (macOS Keychain, libsecret, Windows Credential Manager) and their build constraints.
source
source/gdrive
source/local
source/onedrive
source/sftp
store
store/b2
store/internal/keyprefix
store/local
store/s3
store/sftp
store/storetest
Package storetest provides test doubles for store.ObjectStore.
 Package storetest provides test doubles for store.ObjectStore.

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.