Plakar Documentation

The plakar service command allows you to enable, disable, and inspect additional services that integrate with the Plakar platform. These services connect to the plakar.io infrastructure and are used to extend functionality, such as the alerting service which sends email notifications on operation failure and exposes reports in the Plakar UI.

Important:

• All services are disabled by default.
• Services should only be enabled if you agree to transmit non-sensitive operational data to plakar.io.
• All subcommands require prior authentication via plakar-login(1).

The -group-by flag partitions filtered snapshots by a specific key. When using -group-by, retention matchers (like -days or -per-day) are applied independently within each group rather than across the entire result set.

Supported keys:

• name
• category
• environment
• perimeter
• job
• tag (multi-valued: fans out)
• origin (multi-valued: fans out)
• type (multi-valued: fans out)
• root (multi-valued: fans out)

Note: For multi-valued keys (tag, origin, type, root), a snapshot participates in every group it belongs to and is kept if any group keeps it.

To prevent information leaks (where knowing a cleartext hash could allow an attacker to identify stored data), Plakar avoids using raw cleartext digests for lookups in the repository. Instead, the system uses Message Authentication Codes (MACs).

Key distinction:

• Checksums: Non-secure hash values for detecting accidental errors.
• MACs/Digests: Cryptographic values used for security and integrity.

Plakar's implementation uses MACs for repository lookups to ensure that even if an attacker knows a cleartext hash, they cannot identify the data within the encrypted repository.

Plakar uses Kloset as its underlying immutable data store. You can synchronize Kloset stores across different locations (e.g., to an S3 bucket) to implement 3-2-1 backup strategies or sync workflows.

plakar at /var/backups sync to @s3

Plakar uses password-based hashing to derive keys. While older versions used scrypt, the current design defaults to Argon2id (defined in RFC 9106) for better resistance to side-channel attacks and more intuitive parameterization.

Recommended Argon2id parameters for high security:

• t = 4 (iterations)
• m = 256MB (memory usage)
• If t = 4 is too slow, t = 3 is an acceptable alternative.

Many Plakar subcommands use a combination of matchers and filters to select snapshots. Understanding the difference is key to constructing complex queries:

1. Matchers: These select snapshots. If you provide multiple matchers, the result is the union (OR logic) of those matchers.
2. Filters: These refine the selection made by matchers. If you provide multiple filters, the result is the intersection (AND logic) of those filters.

Default Behavior: If no matcher is provided, all snapshots are implicitly selected, and then the filters are applied to that full set.

The plakar source command is used to manage the configuration of data sources that Plakar can back up. A configuration consists of named entries, where each entry defines a source by specifying an importer (location) and importer-specific parameters.

Available subcommands:

• add <name> <location> [option=value ...] : Create a new source.
• check <name> : Verify if the importer for a source is correctly configured.
• import [...] : Import configurations from files, stdin, or rclone.
• ping <name> : Test if a source is reachable.
• rm <name> : Remove a source.
• set <name> [option=value ...] : Update options for a source.
• show [-secrets] [name ...] : Display current configuration.
• unset <name> [option ...] : Remove an option from a source.

The Plakar agent is a background process that executes plakar(1) commands on behalf of the user to enable faster processing.

In most cases, you do not need to start the agent manually. Most plakar(1) commands will automatically execute the agent if it is not already running. The agent is designed to terminate itself automatically after it has been idle for a certain period.

Plakar uses the following cryptographic primitives by default to ensure data integrity and security:

• Hashing and MAC: Keyed BLAKE3 (replacing SHA256 and HMAC-BLAKE3).
• Chunk Encryption: AES-GCM-SIV (AES256-GCM-SIV).
• Subkey Encryption: AES-KW (AES256-KW).
• Key Derivation Function (KDF): Argon2id.