chill

Description:

chill

chill is a command-line backup tool for incremental, offline (cold storage) and encrypted archives:


offline/cold storage: the archived content is meant to be stored on
disks that are only temporarily attached to a computer


incremental: the tool keeps a local state of the processed files
and skips the ones that are already stored during the previous sessions.


encrypted: the tool encypts the content on the disk so unauthorized tools
or persons cannot observe its content.


Limitations and disclaimers #

May not work.
May lose data.
May not protect data.
Data format is not stable.
Does not track renames and deleted files. (yet)
Does not deduplicates content (within- or cross-sessions).

Warning: This is an opinionated tool for a very special use-case.
If you are unsure about it, please use a different backup tool.
The goal of this tool is to create incremental cold storage archives that can
be stored on offline hard drives at untrusted offsite locations (or cloud storage).
The tool keeps track of the already processed files in a local repository, and
the archived files can be shipped out and kept offline (until a restore is needed).
NOTE: The tool is experimental and may have breaking changes in the future.
Example use #
dart pub global activate chill 0.1.0

dart pub global run chill init \
--repository ~/path/to/local/repository \
--source /path/to/input/one \
--source /path/to/input/two

# backup session with a 800 GiB limit
dart pub global run chill backup \
--repository ~/path/to/local/repository \
--output /mnt/disk1/targetdir \
--limit 800gib
copied to clipboard
# restoring
dart pub global run chill restore \
--repository ~/path/to/local/repository \
--input /mnt/disk1/targetdir \
--output /path/to/restore
copied to clipboard
Respository #
chill stores its main chill.yaml config and its tracking data locally.
This is considered a trusted location and the repository itself is not
encrypted.
Each backup command creates a new session file in the sessions/ subdirectory.
The file contains the session's encryption key and the file chunks that are
stored in the output blob. (Useful information for both incremental updates and
restore)
It is strongly advised to create separate backups of the repository after each session.
Cryptography #
The tool uses ChaCha20-Poly1305-AEAD block cypher to encrypt each content
chunk that is written in a backup session. The encryption key is stored in
the repository's session file, the nonce and the mac is stored alongside
the ciphertext. Each chunk is prepended by a random number of random bytes.