4 ms·
No one said anything about "letting *anything* access"... use IP whitelists and keypairs as needed. The feature you linked will only work with smart backends (
by remram 3y ago
No one said anything about "letting *anything* access"... use IP whitelists and keypairs as needed.
The feature you linked will only work with smart backends (e.g. VM running borg), so if I'm using S3 etc to store my backups I can't use that. That's a big caveat given the pricing difference between object storage (e.g. S3) and block storage (where I can run `borg serve --append-only`).
edit: Actually it seems borg doesn't support object storage at all.
- viraptor 3y agoLetting anything, as in letting any one whitelisted service is still not great. The moment you do pull, you're accepting commands from outside instead of deciding locally what gets sent. This makes the scope for possible vulnerabilities larger. Borg was just one example. And you can still run it effectively append-only by mounting the s3 endpoint locally and setting the right IAM permissions on the bucket.