I have just upgraded and Duplicati fails to start (SettingsEncryptionKeyMissingException). I can’t honestly remember if/how I specified the key before somewhere, but nonetheless before the upgrade it was finding it and after it’s missing. Downgrading makes it work again.
I tried specifying it in the systemd service, but the result was that it claims the key is incorrect.
How can I safely verify if I have a key set up and if the one I believe it’s it it’s correct?
What changed in the new version that caused the issue and how do I fix it?
If I need to set up the key, what’s the best way to add it without putting it in plain text in the systemd service?
That indicates that the key is present in your system somewhere.
It sounds like this is on Linux and using a service to run it?
Are you using pass by any chance?
I decided to remove pass from the default secret provider as it seems to be unmaintained.
If so, you need to add --secret-provider=pass:// or the set environment variable DUPLICATI__SECRET_PROVIDER=pass://.
The fact that Duplicati starts means the key is correct.
That is problematic, because the service should start without user interaction, yet not have a password written on disk. On Windows we use the Windows Credential Manager which is also available to a service, but on Linux the password managers are connected to the desktop which is not available for a service.
You can use an encrypted file (similar to how pass works), but then you need to supply that key in the service file.
thank you for the feedback @kenkendk and apologies for the delay; it sounds like I am not getting email notifications for the replies and I rolled back to the previous version and forgot about it for a while.
Are you using pass by any chance?
apologies for the ignorance, but how do I see if I am?
with systemctl --user edit duplicati.service
but it didn’t work, so I presume I am not using that.
Yes, I am on Arch Linux. I’ll forget about the plain text password for a second, it’s going to be a promblem for tomorrow’s @unosd . For now I would just like to upgrade to the latest version not to remain behind.
Can you suggest a way to figure out where is it taking the key? Maybe enabling debug logs? I’m not sure if I can show it somehow from the UI.
This is automatic, so there are no direct places to see this.
If you can run pass on the commandline, that suggests you have it installed and the Duplicati can use it (assuming it is configured as well).
You can start the secret tool, as it will report the default provider:
duplicati-secret-tool
But you need to run it with the same account as you run Duplicati with.
I would suggest lauching Duplicati once with --disable-db-encryption on the old version. This will decrypt the fields in the database (since the key is apparently available). You can then configure DUPLICATI__SECRET_PROVIDER=file:// with the encryption key, and start again without the --disable-db-encryption switch to have it encrypted with the new key.
After that, you can upgrade to the latest version, and it will use the file.
Sadly, this does not reveal where the key was in the first place.
. For now I would just like to upgrade to the latest version not to remain behind.