EnvironmentVariables
RCLONE_PASSWORD_COMMAND
/usr/bin/security find-generic-password -a USER -s rclone -w
...
```
This configuration seems to work, but is there a better way to allow Kopia to work with an encrypted rclone.conf?
---
### Author:  [@kapitainsky](https://kopia.discourse.group/u/kapitainsky)
#### Post date: [May 18, 2024, 7:43pm UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/2 "2024-05-18T19:43:32Z")
I think your way is very neat and nicely fits into macOS “way” of managing services.
---
### Author:  [@sorgel](https://kopia.discourse.group/u/sorgel)
#### Post date: [May 18, 2024, 8:18pm UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/3 "2024-05-18T20:18:57Z")
Thanks for your reply. Both this one and your other replies on this forum are helpful for newcomers like me.
---
### Author:  [@sorgel](https://kopia.discourse.group/u/sorgel)
#### Post date: [June 11, 2024, 10:28am UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/5 "2024-06-11T10:28:37Z")
Hi, Matvei! Happy to help, but I’m not sure that our setup is close enough to make my explanation useful. So, feel free to ask about details or criticize my suggestions — they could be suboptimal.
In my case, I alread had:
- Rclone with encrypted config.
- Kopia with generated TLS certificate and an added user.
In this case, all we need is:
- Allow kopia to work with encrypted rclone config.
- Make macOS to run kopia as a daemon.
# Allow kopia work with encrypted rclone config
We are going to run Rclone with Kopia, so we aren’t able to input the password interactively. So we’ll put the password in rclone environment variable `RCLONE_PASSWORD_COMMAND`.
1. On macOS we can save our password to keychain with command-line util security. Run in terminal:
```bash
security add-generic-password -a ACCOUNT -s SERVICE -w PASSWORD
```
You can put anything in place of ACCOUNT and SERVICE, these need only for further references. And instead of PASSWORD put your rclone password.
1. To put the password into `RCLONE_PASSWORD_COMMAN` and test it, run:
```bash
export RCLONE_PASSWORD_COMMAND='security find-generic-password -a ACCOUNT -s SERVICE -w'
rclone config
```
Replace ACCOUNT and SERVICE with values you’ve used in the previous step.
If everything is fine, rclone config will be opened without asking your password for decryption.
Now, if you run kopia server from the same terminal instance, it will be able to access the encrypted rclone config. In a new terminal instance repeating of “export…” command will be needed.
# Make macOS to run kopia as daemon
Create a new file at ~/Library/LaunchAgents/com.example.kopia.plist.
My example: [kopia plist template · GitHub](https://gist.github.com/hermannsorgel/e59d462cd67a3c0a21cedb6ca6717006)
Few notes:
```plist
RCLONE_PASSWORD_COMMAND
/usr/bin/security find-generic-password -a ACCOUNT -s SERVICE -w
```
Here we do the same thing as before: putting the rclone password to the environment variable. So replace values with your ones.
```auto
/opt/homebrew/bin/kopia
server
start
--tls-cert-file=PATH_CERT_PATH
--tls-key-file=KEY_CERT_PATH
--address=0.0.0.0:51515
--server-username=KOPIA_USER
```
These options depend on your setup and [the prefered authentication method](https://github.com/kopia/kopia/issues/880#issuecomment-855291217).
```auto
Debug
StandardOutPath
PATH_LOGS
StandardErrorPath
PATH_ERROR_LOGS
```
This section can be omitted. I still watch logs as I’m quite new with kopia. If you also prefer to save logs, replace PATH\_LOGS and PATH\_ERROR\_LOGS with paths of choice. Or remove this section.
With plist file saved, three commands will help to test it:
**Run daemon:**
`bootstrap gui/501 ~/Library/LaunchAgents/com.example.kopia.plist`
**Stop daemon:**
`bootout gui/501 ~/Library/LaunchAgents/com.example.kopia.plist`
**Check if daemon is running:**
`launchctl list | grep kopia`
That’s it. Please, let me know if I’ve missed something. I sure have.
---
### Author:  [@sorgel](https://kopia.discourse.group/u/sorgel)
#### Post date: [June 11, 2024, 11:32am UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/7 "2024-06-11T11:32:41Z")
I haven’t tried KopiaUI, but seems it works the same way. So it should be fine to call `security` from KopiaUI.plist.
In regards to the security of `security` command I have more trust in Apple developers than in me, so I haven’t tried to change anything.
But if you prefer to input the password manually, why ever bother with daemon? Looks like in such a case the user can start Kopia manually and input the password one time on start.
---
### Author:  [@sorgel](https://kopia.discourse.group/u/sorgel)
#### Post date: [June 11, 2024, 11:42am UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/8 "2024-06-11T11:42:00Z")
It’s also possible to use other password managers. For example, KeepassXC can print the password to stdout instead of `security`. Maybe one of the 3rd party password managers will suit your workflow better.
Unfortunately, I’m not the person to ask about security of such solutions.
---
### Author:  [@sorgel](https://kopia.discourse.group/u/sorgel)
#### Post date: [June 11, 2024, 1:23pm UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/10 "2024-06-11T13:23:57Z")
So, first reason I would think about is that I don’t start kopia with `bootstrap… .plist’ but with some other command, so .plist config doesn’t play a role. But I don’t have kopiaUI so don’t know what commands are there to start it.
---
### Author:  [@kapitainsky](https://kopia.discourse.group/u/kapitainsky)
#### Post date: [June 11, 2024, 2:25pm UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/11 "2024-06-11T14:25:08Z")
> [@sorgel](#):
>
> On macOS we can save our password to keychain with command-line util security. Run in terminal:
This step is redundant IMO… as kopia already stores password in macOS keychain.
You can retrieve it by running:
```auto
security find-generic-password -w -s “repository.config-#######”
```
returns:
```
go-keyring-base64:xxxxxxxx
```
Then you have to decode base64 encoded “xxxxxxxx” to password itself.
---
### Author:  [@sorgel](https://kopia.discourse.group/u/sorgel)
#### Post date: [June 11, 2024, 2:31pm UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/12 "2024-06-11T14:31:06Z")
Oh, @kapitainsky, is Kopia able to store password for rclone.config, not repository.config?
If that is the case I’ve totally missed this.
---
### Author:  [@kapitainsky](https://kopia.discourse.group/u/kapitainsky)
#### Post date: [June 11, 2024, 2:58pm UTC](https://kopia.discourse.group/t/kopia-with-encrypted-rclone-config/2918/14 "2024-06-11T14:58:48Z")
You are right. I mixed things:)