Skip to content

Commit 3b42e4a

Browse files
danielfdickinsondanielfdickinson
authored
Add contributed docs for protected configuration on Windows (#394)
* Add contributed docs for protected configuration on Windows Details create resticprofile and resticlogs folders for protected profiles configuration and logs for system-level resticprofile. Signed-off-by: Daniel F. Dickinson <[email protected]> * Fix typos / grammar issues found by CodeRabbitAI Signed-off-by: Daniel F. Dickinson <[email protected]> * Fix typo in new link on contributions page Seem I was tired when I did this one... Signed-off-by: Daniel F. Dickinson <[email protected]> --------- Signed-off-by: Daniel F. Dickinson <[email protected]>
1 parent eb8c721 commit 3b42e4a

File tree

2 files changed

+115
-0
lines changed

2 files changed

+115
-0
lines changed

‎contrib/windows-protected-folder/README.md

+114
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,114 @@
1+
# Windows CLI: Use a protected folder for system-wide configuration
2+
3+
## Overview
4+
5+
You may wish to do system-wide backups using restic/resticprofile
6+
while ensuring only appropriate users can view the secrets in your
7+
profiles and related files.
8+
9+
This document shows one method of using the command-line to set
10+
up resticprofile for system-wide use with a folder which is only
11+
accessible by the Administrators group and the SYSTEM account.
12+
13+
**NB**: This guide applies to Windows 10 and Windows 11, some
14+
differences may exist with previous versions of Windows.
15+
16+
1. [Overview](#overview)
17+
2. [Procedure](#procedure)
18+
1. [Create `resticprofile` folder in `ProgramData`](#create-resticprofile-folder-in-programdata)
19+
2. [Create `resticlogs` folder in `ProgramData`](#create-resticlogs-folder-in-programdata)
20+
3. [(Optional) Pin `resticlogs` folder to Start and/or 'Quick access'](#optional-pin-resticlogs-folder-to-start-andor-quick-access)
21+
4. [Set ACL (permissions) on the `resticprofile` folder](#set-acl-permissions-on-the-resticprofile-folder)
22+
5. [(Optional) Set ACL (permissions) on the `resticlogs` folder](#optional-set-acl-permissions-on-the-resticlogs-folder)
23+
6. [Create your resticprofile profiles configuration file](#create-your-resticprofile-profiles-configuration-file)
24+
3. [Final notes](#final-notes)
25+
26+
## Procedure
27+
28+
### Create `resticprofile` folder in `ProgramData`
29+
30+
1. Open a PowerShell Administrative console and execute:
31+
32+
```powershell
33+
C:
34+
cd \ProgramData
35+
mkdir resticprofile
36+
```
37+
38+
### Create `resticlogs` folder in `ProgramData`
39+
40+
From the same console, execute:
41+
42+
```powershell
43+
cd \ProgramData
44+
mkdir resticlogs
45+
```
46+
47+
### (Optional) Pin `resticlogs` folder to Start and/or 'Quick access'
48+
49+
In the same console, issue: `explorer .` to open File Explorer. Then, right-click on the `resticlogs` folder and choose
50+
'Pin to Start' and/or 'Pin to Quick access'.
51+
52+
This along with the optional permissions below will allow you to view
53+
your resticprofile logs without an elevated session.
54+
55+
### Set ACL (permissions) on the `resticprofile` folder
56+
57+
In the same console, execute:
58+
59+
```powershell
60+
icacls resticprofile /inheritance:d
61+
icacls resticprofile /remove:g BUILTIN\Users
62+
```
63+
64+
You should now see (via `icacls .`):
65+
66+
```plaintext
67+
resticprofile NT AUTHORITY\SYSTEM:(OI)(CI)(F)
68+
BUILTIN\Administrators:(OI)(CI)(F)
69+
CREATOR OWNER:(OI)(CI)(IO)(F)
70+
```
71+
72+
### (Optional) Set ACL (permissions) on the `resticlogs` folder
73+
74+
In the same console execute:
75+
76+
```powershell
77+
icacls resticlogs /inheritance:d
78+
icacls resticlogs /remove:g BUILTIN\Users
79+
icacls resticlogs /grant "YourDomain/YourUser:(OI)(CI)(RX)"
80+
```
81+
82+
where 'YourDomain' and 'YourUser' are your domain or computer name and the user account
83+
specified above.
84+
85+
### Create your resticprofile profiles configuration file
86+
87+
Using a `toml` profile configuration file for the example
88+
89+
```powershell
90+
New-Item resticprofile\profiles.toml
91+
notepad resticprofile\profiles.toml
92+
```
93+
94+
Edit the configuration and save it. Remember to configure the log files to use
95+
the `C:\\ProgramData\\resticlogs\\` folder.
96+
97+
## Final notes
98+
99+
- Resticprofile can now be used from an Administrative console.
100+
101+
- To view the logs, you can use the Start menu or Quick access links you created, or you
102+
can open an Administrative console and issue:
103+
104+
```powershell
105+
type C:\ProgramData\resticlogs\name-of-log.log
106+
```
107+
108+
for a quick view, or
109+
110+
```powershell
111+
notepad C:\ProgramData\resticlogs\name-of-log.log
112+
```
113+
114+
for more in-depth browsing (especially as the logs get larger).

‎docs/content/contributions/_index.md

+1
Original file line numberDiff line numberDiff line change
@@ -16,3 +16,4 @@ I have created a [contributions section](https://github.com/creativeprojects/res
1616
- [get backup status information in zabbix](https://github.com/creativeprojects/resticprofile/tree/master/contrib/zabbix)
1717
- [scheduling inside a docker container](https://github.com/creativeprojects/resticprofile/tree/master/contrib/schedule-in-docker)
1818
- [backup stats in InfluxDB via Telegraf](https://github.com/creativeprojects/resticprofile/tree/master/contrib/telegraf)
19+
- [use a protected folder for configuration on Windows](https://github.com/creativeprojects/resticprofile/tree/master/contrib/windows-protected-folder)

0 commit comments

Comments
 (0)