🔒 Credentials

New in version 1.9.10 Several borgmatic options support reading their values directly from an external credential store or service. To take advantage of this feature, use {credential ...} syntax wherever you'd like borgmatic to read in a credential (for supported options). In borgmatic's configuration, this looks like:

option: "{credential type ...}"

... where:

• option is the name of the configuration option being set
• type is the source of the credential, one of:
  • container: Container secrets
  • file: File-based credentials
  • keepassxc: KeePassXC passwords
  • systemd: systemd service credentials
• "..." provides additional arguments specific to the selected credential type

For example:

encryption_passphrase: "{credential systemd borgmatic.pw}"

The {credential ...} syntax works for several different options in a borgmatic configuration file besides just encryption_passphrase. For instance, the username, password, and API token options within database and monitoring hooks support {credential ...}:

postgresql_databases:
    - name: invoices
      username: postgres
      password: "{credential systemd borgmatic_db1}"

For details about which options support the use of {credential ...} syntax, see the configuration reference.