Revision of pass_backup

Download ZIP

travisshears revised this gist 1780722861. Go to revision

1 file changed, 0 insertions, 0 deletions

gistfile1.txt renamed to HOW.md

File renamed without changes

travisshears revised this gist 1780722840. Go to revision

No changes

travisshears revised this gist 1780722688. Go to revision

No changes

travisshears revised this gist 1780722641. Go to revision

1 file changed, 114 insertions

gistfile1.txt(file created)

		@@ -0,0 +1,114 @@
1	+	# Pass Password Store — Backup Recovery Guide
2	+
3	+	## How to Restore
4	+
5	+	### Prerequisites
6	+
7	+	```bash
8	+	brew install age ssss pass
9	+	```
10	+
11	+	### 1. Reconstruct the passphrase
12	+
13	+	Collect any 3 of the 5 shares, then:
14	+
15	+	```bash
16	+	ssss-combine -t 3 -q
17	+	# paste 3 shares when prompted — outputs the passphrase
18	+	```
19	+
20	+	### 2. Decrypt the archive
21	+
22	+	```bash
23	+	age -d -o secrets.tar.gz secrets.tar.gz.age
24	+	# paste the passphrase when prompted
25	+
26	+	tar -xzf secrets.tar.gz
27	+	```
28	+
29	+	### 3. Import GPG keys
30	+
31	+	```bash
32	+	gpg --import new_pub.asc
33	+	gpg --import new_secret.asc
34	+	```
35	+
36	+	Mark your own key as trusted:
37	+
38	+	```bash
39	+	gpg --edit-key EAB14D8405F7F6CFFE8B26BC5B91EB2A6CA3B89F
40	+	# at the gpg> prompt:
41	+	trust
42	+	# select 5 (ultimate)
43	+	quit
44	+	```
45	+
46	+	### 4. Restore the password store
47	+
48	+	```bash
49	+	git clone pass_backup_YYYYMMDD.bundle ~/.password-store
50	+	```
51	+
52	+	Another option is to just clone it to a tmp dir and decrypt indivual files manually as needed
53	+
54	+	### 5. Verify
55	+
56	+	```bash
57	+	pass ls
58	+	```
59	+
60	+
61	+	## How the backup was created
62	+
63	+	1. Create secrets dir
64	+	1. Export GPG keys to secrets dir
65	+	1. Create Git Bundle and move it to secrets dir
66	+	1. Tar compress the secrets dir
67	+	1. Generate password
68	+	1. Use password to encrypt the sectets dir with age
69	+	1. split the password with ssss
70	+
71	+
72	+	### 1. Create Git Bundle
73	+
74	+	```bash
75	+	mkdir /tmp/pass-backup
76	+	cd ~/.password-store
77	+	git bundle create /tmp/pass-backup/pass_backup_$(date +%Y%m%d).bundle --all
78	+	```
79	+
80	+	This exports the full repo with complete history. The resulting file can be cloned directly:
81	+
82	+	```bash
83	+	git clone pass_backup_YYYYMMDD.bundle restored-password-store
84	+	```
85	+
86	+	### 2. Export GPG Keys
87	+
88	+	```bash
89	+	gpg --export xxxxxxxxxxx > new_pub.asc
90	+	gpg --export-secret-keys --armor xxxxxxxxxx > new_secret.asc
91	+	```
92	+
93	+	### 2. Encrypt the bundle with age
94	+
95	+	```bash
96	+	$ brew install age
97	+	$ age -p pass_backup_20260605.bundle > pass_backup_20260605.bundle.age
98	+	```
99	+
100	+
101	+	### 3. Gen password
102	+
103	+	```bash
104	+	openssl rand -base64 96 > pw.txt
105	+	```
106	+
107	+	Then go in and delete the newline
108	+
109	+
110	+	### 4. Split file with ssss
111	+
112	+	```bash
113	+	cat pw.txt \| ssss-split -t 3 -n 5 -q > splits.txt
114	+	```

Newer Older