Borg: append-only questions

[rugk]

Some questions (situation: borg running on server & client):

1. When append-only is set in the config file this is equally secure to setting it as a parameter in the ssh authorized_keys, is not it?
2. This means in this case also the whole repo cannot be deleted by the borg-client, am I right?
3. Is it bad when the value for "append-only" is changed in the middle of a backup process?
4. Once an archive is created the client cannot change the value for append-only, am I right?

[ThomasWaldmann]

IIRC:

1. yes
2. yes
3. config is read when the borg operation starts, so changing it afterwards does not affect the current borg operation.
4. yes

[rugk]

Okay, thanks for your reply. All questions answered… :smiley:

[rugk]

Could I just add another question?

1. When append-only is activated and some days/backups/prune processes later it is deactivated, which commands trigger the actual deletion of the (old, as "delete" marked) data? Is it even done when one just uses borg list. Or only with borg create or maybe even only when another borg prune is started?

(BTW, you can label this with the "question" tag.)

[ThomasWaldmann]

@rugk anything that invokes compact_segments() - usually this is done after the commit() of a writing operation.

[rugk]

Ah, so this needs a writing operation… Is there any way to trigger such a one in a simple way in order just to execute this "scheduled actions"?

[ThomasWaldmann]

everything that triggers a repo commit also triggers compact_segments if repo is not append-only:

init, create, delete / prune, rename, check --repair, debug put obj, debug del obj.

[rugk]

Hmm, okay, so check might be a good choice. But only the repair version works? And does it even work if the check does not notice anything to repair? (So does it always work?)

[rugk]

I assume (1st question) yes and (2nd) no. Also doing a check there everytime also does not seem good.

BTW. This issue is still not tagged with "question".

[enkore]

yes / yes

There was some talk about adding a separate command just for triggering this, possibly as part of a borg tune command group. See #2195.

[rugk]

Thanks, so finally one last question: Does it also work when only checking the repo (--repository-only), so that one can minimize network traffic?

[rugk]

Thanks, so finally one last question: Does it also work when only checking the repo (--repository-only), so that one can minimize network traffic?

[enkore]

yes

[rugk]

Oh, that's great. :smile: