feat: forward RESTIC_* env to workers

.golangci.toml

@@ -97,7 +97,7 @@ linters = ["govet"]
 
 [[linters.exclusions.rules]]
 path    = "_test\\.go"
-linters = ["errchkjson", "gocognit", "godoclint", "gosec"]
+linters = ["errchkjson", "gocognit", "godoclint", "gosec", "lll"]
 
 [formatters]
 enable = ["gofumpt", "goimports"]

README.md

@@ -54,6 +54,7 @@ The daemon runs `restic` in a short-lived worker container named `volkeep-worker
 | `VOLKEEP_HOST`           | required        | Identifier for `restic snapshots --host` |
 | `RESTIC_REPOSITORY`      | required        | Restic URI, or `volume:<name>` (local)   |
 | `RESTIC_PASSWORD`        | required        | Restic repo password                     |
+| `RESTIC_*`               | —               | Forwarded to workers (tuning)            |
 | `AWS_*`                  | —               | Forwarded to workers (S3 backends)       |
 | `RCLONE_*`               | —               | Forwarded to workers (rclone backends)   |
 | `VOLKEEP_RETENTION_DAYS` | `5`             | Daily snapshots to keep                  |

internal/restic/restic.go

@@ -13,15 +13,21 @@ const (
 	ExitRepoMissing = 10
 )
 
-// WorkerEnv returns the env forwarded to every worker:
-// repo credentials plus the AWS_* and RCLONE_* entries from environ.
+// WorkerEnv returns the env forwarded to every worker: the resolved repo
+// credentials plus the RESTIC_*, AWS_*, and RCLONE_* entries from environ.
 func WorkerEnv(repository, password string, environ []string) []string {
 	env := []string{
 		"RESTIC_REPOSITORY=" + repository,
 		"RESTIC_PASSWORD=" + password,
 	}
 	for _, kv := range environ {
-		if strings.HasPrefix(kv, "AWS_") || strings.HasPrefix(kv, "RCLONE_") {
+		if strings.HasPrefix(kv, "RESTIC_REPOSITORY=") ||
+			strings.HasPrefix(kv, "RESTIC_PASSWORD=") {
+			continue
+		}
+		if strings.HasPrefix(kv, "RESTIC_") ||
+			strings.HasPrefix(kv, "AWS_") ||
+			strings.HasPrefix(kv, "RCLONE_") {
 			env = append(env, kv)
 		}
 	}

internal/restic/restic_test.go

@@ -9,13 +9,22 @@ import (
 func TestWorkerEnv(t *testing.T) {
 	t.Parallel()
 
-	environ := []string{"PATH=/bin", "AWS_ACCESS_KEY_ID=id", "HOME=/root", "RCLONE_CONFIG_R_TYPE=s3"}
+	environ := []string{
+		"PATH=/bin",
+		"AWS_ACCESS_KEY_ID=id",
+		"HOME=/root",
+		"RCLONE_CONFIG_R_TYPE=s3",
+		"RESTIC_COMPRESSION=max",
+		"RESTIC_REPOSITORY=volume:stale",
+		"RESTIC_PASSWORD=stale",
+	}
 	assert.Equal(t, []string{
 		"RESTIC_REPOSITORY=s3:h/b",
 		"RESTIC_PASSWORD=pw",
 		"AWS_ACCESS_KEY_ID=id",
 		"RCLONE_CONFIG_R_TYPE=s3",
-	}, WorkerEnv("s3:h/b", "pw", environ))
+		"RESTIC_COMPRESSION=max",
+	}, WorkerEnv("s3:h/b", "pw", environ), "resolved credentials supersede the daemon's copies")
 
 	assert.Equal(t, []string{
 		"RESTIC_REPOSITORY=/repo",