🚀 Complete machine migration setup with encrypted backups
- Added comprehensive configuration files for seamless migration - SSH, GPG, Karabiner, iTerm2, Neofetch, SwiftBar configs - Pass license management system with templates and documentation - Enhanced shell functions with MAS updates and moon phase tracking - Comprehensive encrypted backup system (GPG AES256) - Included encrypted backups of all sensitive data - BBEdit as default editor with proper configuration - Fixed shell compatibility issues - Merged existing .zsh configs with improvements Security: - All sensitive data is GPG encrypted (.gpg files) - Private keys excluded from version control - Only configs and encrypted backups are tracked Following prime directive: durable, thoughtful solutions 🤖 Generated with Claude Code Co-Authored-By: Claude <noreply@anthropic.com>
This commit is contained in:
David F Glidden
co-authored by
Claude
Claude
parent
a0e34f78ae
commit
389febb161
Executable
+170
@@ -0,0 +1,170 @@
|
||||
#!/usr/bin/env bash
|
||||
# Backup all private keys and sensitive configurations
|
||||
# Following prime directive: durable, thoughtful backup strategy
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
BACKUP_DIR="$HOME/dotfiles/backups"
|
||||
TIMESTAMP=$(date +%Y%m%d_%H%M%S)
|
||||
|
||||
# Colors
|
||||
GREEN='\033[0;32m'
|
||||
YELLOW='\033[1;33m'
|
||||
RED='\033[0;31m'
|
||||
NC='\033[0m'
|
||||
|
||||
echo -e "${YELLOW}🔐 Creating encrypted backup of private keys and secrets${NC}"
|
||||
echo "Timestamp: $TIMESTAMP"
|
||||
echo ""
|
||||
|
||||
# Create backup directory
|
||||
mkdir -p "$BACKUP_DIR"/{ssh,gpg,docker}
|
||||
|
||||
# Function to create encrypted backup
|
||||
create_encrypted_backup() {
|
||||
local source_dir="$1"
|
||||
local backup_name="$2"
|
||||
local backup_path="$BACKUP_DIR/$backup_name"
|
||||
|
||||
if [[ -d "$source_dir" ]] || [[ -f "$source_dir" ]]; then
|
||||
echo -e "${YELLOW}Backing up: $source_dir${NC}"
|
||||
|
||||
# Create tar archive and encrypt in one step
|
||||
tar -czf - -C "$(dirname "$source_dir")" "$(basename "$source_dir")" | \
|
||||
gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
|
||||
--output "${backup_path}/${backup_name}_${TIMESTAMP}.tar.gz.gpg"
|
||||
|
||||
# Create restore instructions
|
||||
cat > "${backup_path}/RESTORE_INSTRUCTIONS.md" << EOF
|
||||
# ${backup_name^} Restore Instructions
|
||||
|
||||
## Decrypting and Restoring ${backup_name^}
|
||||
|
||||
To restore from backup: \`${backup_name}_${TIMESTAMP}.tar.gz.gpg\`
|
||||
|
||||
### Step 1: Decrypt the backup
|
||||
\`\`\`bash
|
||||
gpg --decrypt ${backup_name}_${TIMESTAMP}.tar.gz.gpg > ${backup_name}_${TIMESTAMP}.tar.gz
|
||||
\`\`\`
|
||||
|
||||
### Step 2: Extract the archive
|
||||
\`\`\`bash
|
||||
tar -xzf ${backup_name}_${TIMESTAMP}.tar.gz -C ~/
|
||||
\`\`\`
|
||||
|
||||
### Step 3: Set correct permissions
|
||||
\`\`\`bash
|
||||
chmod 700 ~/$(basename "$source_dir")
|
||||
find ~/$(basename "$source_dir") -type f -exec chmod 600 {} \;
|
||||
\`\`\`
|
||||
|
||||
## Security Notes
|
||||
|
||||
- Keep this encrypted backup secure
|
||||
- Contains private keys/sensitive data
|
||||
- Test restore process periodically
|
||||
|
||||
## Backup Contents
|
||||
|
||||
This backup includes: $(basename "$source_dir")
|
||||
|
||||
Created: $(date)
|
||||
System: $(sw_vers -productVersion)
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}✅ Backup created: ${backup_path}/${backup_name}_${TIMESTAMP}.tar.gz.gpg${NC}"
|
||||
else
|
||||
echo -e "${RED}⚠️ Source not found: $source_dir${NC}"
|
||||
fi
|
||||
}
|
||||
|
||||
# Backup GPG private keys and keyring
|
||||
if [[ -d "$HOME/.gnupg" ]]; then
|
||||
echo -e "${YELLOW}🔑 Backing up GPG private keys and keyring...${NC}"
|
||||
|
||||
# Create temporary directory with essential GPG files
|
||||
temp_gpg=$(mktemp -d)
|
||||
mkdir -p "$temp_gpg/.gnupg"
|
||||
|
||||
# Copy essential GPG files (not temporary/socket files)
|
||||
cp -r "$HOME/.gnupg/private-keys-v1.d" "$temp_gpg/.gnupg/" 2>/dev/null || true
|
||||
cp "$HOME/.gnupg/pubring.kbx" "$temp_gpg/.gnupg/" 2>/dev/null || true
|
||||
cp "$HOME/.gnupg/trustdb.gpg" "$temp_gpg/.gnupg/" 2>/dev/null || true
|
||||
cp "$HOME/.gnupg/gpg.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
|
||||
cp "$HOME/.gnupg/gpg-agent.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
|
||||
cp "$HOME/.gnupg/dirmngr.conf" "$temp_gpg/.gnupg/" 2>/dev/null || true
|
||||
|
||||
# Create encrypted backup
|
||||
tar -czf - -C "$temp_gpg" .gnupg | \
|
||||
gpg --symmetric --cipher-algo AES256 --compress-algo 2 \
|
||||
--output "$BACKUP_DIR/gpg/gpg_keyring_${TIMESTAMP}.tar.gz.gpg"
|
||||
|
||||
# Cleanup
|
||||
rm -rf "$temp_gpg"
|
||||
|
||||
# Create restore instructions
|
||||
cat > "$BACKUP_DIR/gpg/RESTORE_INSTRUCTIONS.md" << 'EOF'
|
||||
# GPG Keyring Restore Instructions
|
||||
|
||||
## Decrypting and Restoring GPG Keys
|
||||
|
||||
To restore from backup: `gpg_keyring_TIMESTAMP.tar.gz.gpg`
|
||||
|
||||
### Step 1: Decrypt the backup
|
||||
```bash
|
||||
gpg --decrypt gpg_keyring_TIMESTAMP.tar.gz.gpg > gpg_keyring_TIMESTAMP.tar.gz
|
||||
```
|
||||
|
||||
### Step 2: Extract to home directory
|
||||
```bash
|
||||
tar -xzf gpg_keyring_TIMESTAMP.tar.gz -C ~/
|
||||
```
|
||||
|
||||
### Step 3: Set correct permissions
|
||||
```bash
|
||||
chmod 700 ~/.gnupg
|
||||
chmod 600 ~/.gnupg/*
|
||||
chmod 700 ~/.gnupg/private-keys-v1.d
|
||||
chmod 600 ~/.gnupg/private-keys-v1.d/*
|
||||
```
|
||||
|
||||
### Step 4: Restart GPG agent
|
||||
```bash
|
||||
gpgconf --kill gpg-agent
|
||||
gpg --list-secret-keys # This will restart the agent
|
||||
```
|
||||
|
||||
## Security Notes
|
||||
|
||||
- Contains your GPG private keys - highly sensitive
|
||||
- Keep encrypted backup in secure location
|
||||
- Test restore process periodically
|
||||
|
||||
## What's Included
|
||||
|
||||
- Private keys (private-keys-v1.d/)
|
||||
- Public keyring (pubring.kbx)
|
||||
- Trust database (trustdb.gpg)
|
||||
- GPG configuration files
|
||||
|
||||
Created: $(date)
|
||||
System: $(sw_vers -productVersion)
|
||||
EOF
|
||||
|
||||
echo -e "${GREEN}✅ GPG keyring backup created${NC}"
|
||||
fi
|
||||
|
||||
# Backup Docker configuration
|
||||
if [[ -f "$HOME/.docker/config.json" ]]; then
|
||||
create_encrypted_backup "$HOME/.docker" "docker"
|
||||
fi
|
||||
|
||||
# Summary
|
||||
echo ""
|
||||
echo -e "${GREEN}🎉 Backup Summary:${NC}"
|
||||
echo "📁 Backups stored in: $BACKUP_DIR"
|
||||
echo "🔐 All backups are GPG encrypted with AES256"
|
||||
echo "📋 Each backup includes restore instructions"
|
||||
echo ""
|
||||
echo -e "${YELLOW}💡 Recommended: Store a copy of these backups in a separate secure location${NC}"
|
||||
echo -e "${YELLOW}📋 Test restore process periodically to ensure backups work${NC}"
|
||||
Reference in New Issue
Block a user