gob-cli — Go Backups

Scheduled rsync + encrypted zip archiver daemon. Backs up files from remote hosts (or local paths) on a schedule, stores each unique content as a password-protected zip, and prunes old versions. Optional authenticated web UI to browse and download archives.

# Download from releases
curl -sSL https://github.com/javimosch/gob-cli/releases/latest/download/gob-cli-linux-amd64 -o /usr/local/bin/gob-cli
chmod +x /usr/local/bin/gob-cli

# Or build from source
git clone https://github.com/javimosch/gob-cli.git
cd gob-cli
./build.sh

# Create a backup config
mkdir -p ~/.config/gob-cli
cat > ~/.config/gob-cli/config.json << 'EOF'
{
  "backups": [
    {
      "name": "my-env",
      "source": "myserver:/path/to/.env",
      "dest": "/home/user/gob-backups",
      "method": "rsync",
      "password": "my-secret",
      "retention": 7,
      "enabled": true
    }
  ]
}
EOF

# Run once (foreground)
gob-cli start

# Run as background daemon
gob-cli start -daemon

# Run with status UI on port 8080
gob-cli start -port 8080

# With master password (fallback for all backups)
gob-cli start -daemon -password 'master-pass'

# Via env
export GOB_CLI_PASSWORD='master-pass'
gob-cli start -daemon

~/.config/gob-cli/config.json

{
  "backups": [
    {
      "name": "my-env",
      "source": "server:/remote/path",
      "dest": "/home/user/gob-backups",
      "method": "rsync",
      "password": "zip-encryption-password",
      "retention": 7,
      "schedule": "@hourly",
      "enabled": true
    }
  ]
}

Passwords are resolved in order: per-backup password > --password flag > GOB_CLI_PASSWORD env var.

Start with -port to enable the HTTP server:

gob-cli start -port 8080 -user admin

The UI provides:

• Browse backup targets with expandable archive lists
• Download zip archives with one click
• Status dashboard with uptime, archive count, total size
• Basic auth protection when -user is set

Per-IP sliding window rate limiting protects the UI and API from brute force attacks:

• Default: 30 requests/minute per IP
• Configure with --rate-limit N or --rate-limit 0 to disable
• Returns 429 Too Many Requests with Retry-After: 60 header
• Respects X-Forwarded-For and X-Real-IP headers behind proxies
• Stale entries are purged every 5 minutes

1. Every hour, the scheduler checks each enabled backup
2. Rsync pulls the file from source to a temp directory
3. SHA256 is computed — if the content is new, a password-protected zip is created
4. Zips are named {name}_{timestamp}_{sha[:16]}.zip
5. Retention enforcement removes the oldest unique-SHA zips beyond the limit

• rsync (for remote sources over SSH)
• zip (for password-protected archives)
• SSH key access to remote hosts (for rsync over SSH)

MIT