From 6b0776003dd240af9e31476f2c5658ebb6d0292b Mon Sep 17 00:00:00 2001
From: trnq1ll0 <rob.tranquillo@gmx.de>
Date: Sun, 8 Mar 2026 19:26:53 +0100
Subject: [PATCH] use ssh key file

---
 code/backup_rsync_git.env         |  3 +++
 code/backup_rsync_git.env.example |  8 +++++++-
 code/backup_rsync_git.sh          | 21 ++++++++++++++++++++-
 3 files changed, 30 insertions(+), 2 deletions(-)

diff --git a/code/backup_rsync_git.env b/code/backup_rsync_git.env
index 64c0d8b..efc0989 100644
--- a/code/backup_rsync_git.env
+++ b/code/backup_rsync_git.env
@@ -1,5 +1,8 @@
 # Remote rsync source. Example: backup@example.com:/srv/data/project/
 RSYNC_SOURCE="boogie@eukelade.uberspace.de:/home/boogie/nextcloud_data/root/files/Obsidian"
+# SSH key file used by rsync/ssh
+SSH_KEY_FILE="/home/truenas_admin/.ssh/backup_rsync"
+
 
 # Local sync destination (must be a directory inside GIT_REPO_DIR)
 RSYNC_TARGET_DIR="/mnt/bfds-nix/rob/backup/Obsidian-daily-git/Obsidian"
diff --git a/code/backup_rsync_git.env.example b/code/backup_rsync_git.env.example
index 96e8330..d2e69a6 100644
--- a/code/backup_rsync_git.env.example
+++ b/code/backup_rsync_git.env.example
@@ -8,5 +8,11 @@ RSYNC_TARGET_DIR="/path/to/backup-repo"
 # Prefix for commit message (timestamp is appended automatically)
 COMMIT_MESSAGE_PREFIX="backup: rsync sync"
 
-# Optional: custom SSH command for rsync (leave empty if not needed)
+# SSH key file used by rsync/ssh
+SSH_KEY_FILE="/root/.ssh/backup_rsync"
+
+# Optional extra SSH options
+# SSH_OPTIONS="-o IdentitiesOnly=yes -o StrictHostKeyChecking=yes"
+
+# Optional full custom SSH command for rsync (overrides SSH_KEY_FILE/SSH_OPTIONS)
 # RSYNC_RSH="ssh -i /path/to/key -o StrictHostKeyChecking=yes"
diff --git a/code/backup_rsync_git.sh b/code/backup_rsync_git.sh
index 31f5c24..b157467 100755
--- a/code/backup_rsync_git.sh
+++ b/code/backup_rsync_git.sh
@@ -37,6 +37,18 @@ for var in "${required_vars[@]}"; do
   fi
 done
 
+if [[ -z "${RSYNC_RSH:-}" && -z "${SSH_KEY_FILE:-}" ]]; then
+  echo "Missing SSH config: set SSH_KEY_FILE or RSYNC_RSH" >&2
+  exit 1
+fi
+
+if [[ -n "${SSH_KEY_FILE:-}" && ! -r "$SSH_KEY_FILE" ]]; then
+  echo "SSH key file not readable: $SSH_KEY_FILE" >&2
+  exit 1
+fi
+
+mkdir -p "$RSYNC_TARGET_DIR"
+
 repo_abs="$(cd "$RSYNC_TARGET_DIR" && pwd)"
 
 rel_target="."
@@ -50,7 +62,14 @@ git_target() {
 }
 
 if [[ -n "${RSYNC_RSH:-}" ]]; then
-  rsync -az --delete -e "$RSYNC_RSH" "$RSYNC_SOURCE" "$repo_abs/"
+  rsync_rsh="$RSYNC_RSH"
+else
+  ssh_options="${SSH_OPTIONS:--o IdentitiesOnly=yes -o StrictHostKeyChecking=yes}"
+  rsync_rsh="ssh -i $SSH_KEY_FILE $ssh_options"
+fi
+
+if [[ -n "${rsync_rsh:-}" ]]; then
+  rsync -az --delete -e "$rsync_rsh" "$RSYNC_SOURCE" "$repo_abs/"
 else
   rsync -az --delete "$RSYNC_SOURCE" "$repo_abs/"
 fi