Environment Variables

github-backup reads several environment variables so that secrets stay out of the command line, shell history and the process list. A variable that is set but empty is treated as unset (container launchers often pass every optional variable as an empty string); surrounding whitespace, such as a newline pasted with a token, is trimmed.

Authentication

VariableFlag equivalentDescription
GITHUB_TOKEN--tokenGitHub personal access token
GITHUB_OAUTH_CLIENT_ID--oauth-client-idOAuth App client ID; ignored unless --device-auth is given

GitHub Enterprise

VariableFlag equivalentDescription
GITHUB_API_URL--api-urlAPI base URL (for example https://github.example.com/api/v3)
GITHUB_CLONE_HOST--clone-hostHostname used in git clone URLs

S3 Storage and Encryption

VariableFlag equivalentDescription
AWS_ACCESS_KEY_ID--s3-access-keyS3 access key ID
AWS_SECRET_ACCESS_KEY--s3-secret-keyS3 secret access key
AWS_SESSION_TOKEN--s3-session-tokenSession token for temporary credentials
BACKUP_ENCRYPT_KEY--encrypt-key64 hexadecimal characters: AES-256-GCM key for the S3 upload (and for --decrypt)

The three AWS_* variables are ignored unless --s3-bucket is given, so credentials exported for other tools never affect a run that does not use S3. AWS_PROFILE, ~/.aws/credentials and instance metadata are not read.

Mirror Push

VariableFlag equivalentDescription
MIRROR_TOKEN--mirror-tokenAPI token of the Gitea / Codeberg / Forgejo / GitLab destination; ignored unless --mirror-to is given

Notification and Restore

VariableFlag equivalentDescription
BACKUP_NOTIFY_WEBHOOK--notify-webhookURL that receives the JSON status after a run
GITHUB_BACKUP_RESTORE_YES--restore-yesThe value 1 confirms --restore without the interactive prompt

Proxy

VariableDescription
HTTPS_PROXY / https_proxyProxy for https:// targets
HTTP_PROXY / http_proxyProxy for http:// targets
ALL_PROXY / all_proxyFallback for both when the specific variable is unset
NO_PROXY / no_proxyComma-separated exceptions: *, host names (also match subdomains), IP addresses, CIDR blocks such as 10.0.0.0/8, each with an optional :port

The lower-case spelling wins when both are set. The proxy must be an HTTP proxy (http://[user:pass@]host[:port], port 3128 if omitted; credentials are sent as Proxy-Authorization: Basic). https:// targets are reached through an HTTP CONNECT tunnel. A value that is not a usable HTTP proxy URL (socks5://... for example) is ignored with a warning. SOCKS proxies are not supported.

What the variables apply to:

TrafficUses the proxy settings?
GitHub API calls, including release-asset downloadsyes
--notify-webhookyes
--doctor / --checkyes (the same client as the backup)
git clone, git fetch, git push (the git binary)by git's own rules: git reads the same variables (https_proxy, no_proxy, ...) or its http.proxy setting
S3 requestsno, they connect to the endpoint directly
Gitea / GitLab API calls of --mirror-tono, they connect directly (the git push itself follows git's rules)
export HTTPS_PROXY=http://proxy.corp.example.com:3128
export NO_PROXY=localhost,.corp.example.com
github-backup octocat --output /backup --all

TLS

VariableDescription
SSL_CERT_FILE, SSL_CERT_DIRExtra or alternative trust store for the tool's own TLS clients (GitHub API, S3, webhook, mirror API). Without them the operating system's certificate store is used.
GIT_SSL_CAINFOThe same for the git subprocesses (git has its own setting)

Logging

VariableDescription
RUST_LOGA tracing filter. When set it replaces the level chosen by -q, -v and -vv.
NO_COLORSet and non-empty: no ANSI colour.
CLICOLOR_FORCE1: colour even when stderr is not a terminal.

Logs go to stderr; the banners, --doctor, --list-scopes and --print-config-template print to stdout.

# Warnings and errors only
RUST_LOG=warn github-backup ...

# Debug output of the API client only
RUST_LOG=github_backup_client=debug github-backup ...

Container Variables

The image's entrypoint additionally reads GITHUB_OWNER, BACKUP_MODE, BACKUP_FLAGS and UMASK when it is started without arguments; see Docker. They are not read by the github-backup binary.

Setting Variables Securely

For interactive use, read keeps the token out of the shell history:

read -rs GITHUB_TOKEN && export GITHUB_TOKEN

For systemd services use EnvironmentFile= with a 0600 file; for Docker use --env-file or -e GITHUB_TOKEN (no value, so the secret is not in the docker command line); for Kubernetes use a Secret.

[Service]
EnvironmentFile=/etc/github-backup/secrets.env

# /etc/github-backup/secrets.env (mode 0600)
GITHUB_TOKEN=ghp_dummy_token_for_illustration