Backup & Restore

Losing SSH keys can result in permanent loss of access to infrastructure, Git repositories, and encrypted data. SKM treats backup as a first-class citizen, offering two distinct mechanisms: a quick local Tarball export, and a highly secure, encrypted snapshot system via Restic.

Method 1: Standard Backup (Tarball Archive)

The standard backup method is perfect for quickly migrating your keys to a new machine. It bundles your entire ~/.skm vault into a compressed .tar.gz archive and drops it into your home directory.

Performing a Backup

skm backup

What happens: SKM invokes the system tar command to compress the store path. It will output a confirmation containing a timestamped filename: 

✔ All SSH keys backup to: /Users/username/skm-20231016170707.tar.gz
Best Practice: Immediately move this archive off your local machine to a secure, private location (like an encrypted USB drive or a trusted password manager's file attachment feature).

Performing a Restore

To restore an SKM setup from an archive, pass the file path to the restore command:

skm restore ~/Downloads/skm-20231016170707.tar.gz

Warning - Destructive Operation! Restoring from a standard tarball is a destructive action. SKM will prompt you (Y/n) to confirm. If you proceed, SKM will:

  1. Delete everything currently in ~/.skm.
  2. Delete the active SSH symlinks from ~/.ssh/.
  3. Extract the archive into ~/.skm.

After a restore, you must run skm use <alias> to set a new active default.

Method 2: Encrypted Snapshots with Restic

If you prioritize security and versioned backups, SKM integrates directly with Restic, a fast, encrypted backup program.

Requirement: You must install the restic binary on your system (e.g., brew install restic or apt-get install restic) for these flags to work.

Initializing Restic and Backing Up

Restic encrypts data at rest, which means it strictly requires a password. SKM streamlines this process by looking for a password file.

  1. Create the password file: Generate a secure, random string and save it to ~/.skm-backups.passwd. 

    openssl rand -hex 64 > ~/.skm-backups.passwd
chmod 600 ~/.skm-backups.passwd # Secure the file permissions!

  2. Run the Restic Backup: 

    skm backup --restic

What happens: The first time you run this, SKM detects that a Restic repository doesn't exist. It will automatically initialize a new, encrypted repository at ~/.skm-backups, using the password file you generated. It also creates a restic.json config file inside your SKM vault. Once initialized, it takes an incremental snapshot of your keys.

Restoring from Restic Snapshots

Restic takes versioned snapshots. To restore, you need to identify which point in time you want to revert to.

1. Finding a Snapshot ID: If you run the restore command without specifying an ID, SKM will output a list of available snapshots and exit safely. 

skm restore --restic
Output: Look for the 8-character ID (e.g., a1b2c3d4) corresponding to the date you wish to restore.

2. Executing the Restore: Pass the target ID using the --restic-snapshot flag: 

skm restore --restic --restic-snapshot a1b2c3d4
This securely pulls the encrypted snapshot from the Restic repository, decrypts it using your password file, and populates your ~/.skm vault.