Backups created before June 12 show as sparkbox-backup-.tar.gz.enc with a 🔒 "Encrypted config" label. Backups after June 14 show as sparkbox-full-.tar.gz labeled "FULL" — no lock icon, no .enc extension, and noticeably larger file sizes (600-900 MB vs 300-500 MB before). BACKUPKEY is still set in .env. The /volume1/sparkbox-data/backups/ directory doesn't exist, so backups are stored elsewhere (location TBD). Question: Did the new "FULL" backup type intentionally drop encryption, or is this a regression? Are the new .tar.gz files actually encrypted despite the extension?
7 replies
tomspark wrote:
Good news first: nothing silently broke and your data is being backed up. Straight answer — no, the sparkbox-full-.tar.gz files are not encrypted. Those are made by the command-line sparkbox backup, which writes a plain (unencrypted) full archive. The encrypted ones you saw before (sparkbox-backup-.tar.gz.enc, with the lock) come from the dashboard's Backup button and the scheduled backups — those encrypt with your key. So it isn't a regression from the update: the command-line backup has always been a plain archive, and it's just bigger now because it includes your real data, not only config. They're saved in your SparkBox folder's backups subfolder (e.g. /opt/sparkbox/backups), not /volume1/... — that's why they seemed missing. One honest flag, since a full backup contains your passwords and Vaultwarden: a plain archive isn't protected, so either keep those files somewhere safe or use the dashboard / scheduled backup for an encrypted one. I'm also going to make the command-line backup encrypt (or at least clearly warn) so this isn't a surprise. Quick question so I can point you right: are you running sparkbox backup yourself, or did you put it on a schedule?
TestedEcho wrote:
I'm very sure that for 2 of the 3 that are unencrypted, that I made them in the config window in the dashboard, the other one I can't really remember... The newest one was when i started wondering what was going wrong...
tomspark wrote:
Thanks for pushing back on that — you're right, and I need to correct what I told you. If those came from the dashboard and landed unencrypted, my 'it was the command-line' answer was wrong for your case. Here's what actually happened: the dashboard always tries to encrypt, but only if it can find your backup key — and if it couldn't, the old code quietly wrote a plain (unencrypted) backup instead of stopping. That's a real bug, and it's why yours came out unprotected. I just shipped a fix (v1.6.264): the dashboard now refuses to make an unencrypted backup and tells you to set the key first, so it can never be silently plaintext again. To get yours encrypting: run sudo sparkbox update, then in Settings - Environment Variables make sure SBBACKUPKEY is set — note the SB prefix; a plain BACKUPKEY won't be picked up, which is likely why it wasn't found. Make a fresh backup after that and it should show the lock and the .enc. One safety note: treat those existing plain sparkbox-full files as sensitive (they contain your passwords and Vaultwarden) — delete them once you have an encrypted one. Genuinely appreciate you catching this.
TestedEcho wrote:
Hey Tom, Tested my backups again after your fix (few days late), but both the v1 and v2 give an unencrypted backup… looks to be an only me thing. It still recognizes my key and shows it will make an encrypted backup, but when I check after it’s done, it shows it’s not…
tomspark wrote:
Appreciate you testing and circling back — and good news, your data's being backed up either way. Let's pin which is happening, because on the current version the dashboard backup always encrypts, so this usually means the fix didn't actually land on your box. Two quick checks: 1) Run sudo sparkbox doctor and tell me the version on the very top line — it needs to read 1.6.264 or higher. There've been some update hiccups going around, so worth confirming it actually moved. 2) Make a fresh backup from the dashboard, then tell me the exact name of the newest file in your backups folder — does it end in .enc? If the version is below 1.6.264, that's the whole story and we'll get it properly updated. If it's 1.6.264+ and the file still isn't .enc, that's a real one and I'll dig straight in. Either way, treat those existing plain files as sensitive (they hold your passwords and Vaultwarden) until you've got an encrypted one.
TestedEcho wrote:
I’m on 1.6.315. Every update I tried since is unencrypted. It can see my key and says encryption is on. Btw, is it ok there haven’t been updates last week? Or are you on a trip or vacation? Else there is something wrong with the updates..
Chris wrote:
Coming back to this far later than you deserved, and I'm sorry for the silence. Two things. You were testing on 1.6.315, and a further backup-encryption fix landed after that version — so the build you were checking never had it. And updates haven't stopped: the fleet is on 1.6.464 now. There is a known group of boxes that got stranded mid-update and need one manual push before they start moving again, which fits what you were seeing. sudo sparkbox upgrade Use upgrade here, not update — update only refreshes your app images and cannot move you onto a newer release. Then take a fresh dashboard backup and tell me whether the newest file ends in .enc. If it is still plain, I'll take it to Tom rather than guess at it. Meanwhile, treat the unencrypted ones as sensitive — they contain your .env secrets. — Chris