copy command ENV variables

[ilium007]

I have a Wasabi S3 repo that won't init within the 'copy' section of a profile. If I set the same repo in a seperate section with exactly the same env credentials it works fine.

I need to initialize the 'copy' section of the profile so that I can copy the chunker params.

These keys are being ignored:

AWS_ACCESS_KEY_ID: xxxx
AWS_SECRET_ACCESS_KEY: xxxx

Versions:

sudo docker exec -it bc7c0511e538 restic version
restic 0.18.1 compiled with go1.25.1 on linux/amd64

sudo docker exec -it bc7c0511e538 resticprofile version
resticprofile version 0.32.0 commit f222ed24006d6161767106cb8b9f38fe74266473

Snippet of config file:

default:
  host: xxxx
  repository: xxxx
  password-file: /resticprofile/key
  initialize: true
  source:
    - /homes
  env:
    GOGC: 20

  copy:
    host: xxxx
    repository: s3:https://s3.ap-southeast-2.wasabisys.com/xxxx
    password-file: /resticprofile/key
    initialize: true
    initialize-copy-chunker-params: true
    snapshot: latest

    env:
      GOGC: 20
      AWS_ACCESS_KEY_ID: xxxx
      AWS_SECRET_ACCESS_KEY: xxxx

wasabi:
  host: xxxx
  repository: s3:https://s3.ap-southeast-2.wasabisys.com/xxxx
  password-file: /resticprofile/key
  initialize: true

  env:
    GOGC: 20
    AWS_ACCESS_KEY_ID: xxxx
    AWS_SECRET_ACCESS_KEY: xxxx

  forget:
    host: xxxx
    keep-daily: 90
    keep-tag:
      - protected
    prune: true

Fails when calling the copy command under 'default' profile':

sudo docker exec -it bc7c0511e538 resticprofile default.copy

2025/12/30 10:31:48 using configuration file: profiles.yaml
2025/12/30 10:31:48 profile 'default': initializing repository (if not existing)
2025/12/30 10:31:48 profile 'default': initializing secondary repository (if not existing)
repository 04db531b opened (version 2, compression level auto)
2025/12/30 10:32:20 profile 'default': starting 'copy'
repository 04db531b opened (version 2, compression level auto)
Fatal: unable to open repository at s3:https://s3.ap-southeast-2.wasabisys.com/xxxx: s3.getCredentials: no credentials found. Use `-o s3.unsafe-anonymous-auth=true` for anonymous authentication
2025/12/30 10:32:53 copy on profile 'default': exit status 1

Works (repo is initialised) when using the 'wasabi' profile:

sudo docker exec -it bc7c0511e538 resticprofile wasabi.snapshots

2025/12/30 10:29:26 using configuration file: profiles.yaml
2025/12/30 10:29:26 profile 'wasabi': initializing repository (if not existing)
created restic repository 822a045c5a at s3:https://s3.ap-southeast-2.wasabisys.com/xxxx

Please note that knowledge of your password is required to access
the repository. Losing your password means that your data is
irrecoverably lost.
2025/12/30 10:29:29 profile 'wasabi': starting 'snapshots'
repository 822a045c opened (version 2, compression level auto)
created new cache in /resticprofile/cache
2025/12/30 10:29:31 profile 'wasabi': finished 'snapshots'

[ilium007]

Verified that env variables are being ignored.

During copy command:

sudo docker exec -it bc7c0511e538 resticprofile -v default.copy
2025/12/30 11:01:07 resticprofile 0.32.0 compiled with go1.25.5
2025/12/30 11:01:07 using configuration file: profiles.yaml
2025/12/30 11:01:07 loading: profiles.yaml
2025/12/30 11:01:07 memory available: 1054MB
2025/12/30 11:01:07 using restic 0.18.1
2025/12/30 11:01:07 profile 'default': initializing repository (if not existing)
2025/12/30 11:01:07 replaced plain "repository" argument with "repository-file" (/tmp/resticprofile3947221566/t/default-repo.txt) to avoid password leak
2025/12/30 11:01:07 command environment:
GOGC=20

2025/12/30 11:01:07 starting command: /usr/bin/restic init --password-file=/resticprofile/key --repository-file=/tmp/resticprofile3947221566/t/default-repo.txt --verbose=1
2025/12/30 11:01:07 profile 'default': initializing secondary repository (if not existing)
2025/12/30 11:01:07 replaced plain "repository" argument with "repository-file" (/tmp/resticprofile3947221566/t/default-from-repo.txt) to avoid password leak
2025/12/30 11:01:07 command environment: reusing previous

[ilium007]

So it looks like env: can't be overwritten in the copy command (or probably any child command in a profile), copy can only inherit env: from default:

Surely we should be able to overwrite env: variables in child commands? What if I need different AWS keys for backup vs copy? As it stands I could not have an AWS backup repo that has different auth credentials to an AWS copy repo.

[ilium007]

It looks like the only way I can have a different AWS S3 repo for the copy (to the backup S3) is by specifying the second S3 location using rclone.

[ilium007]

I hav been using https://github.com/alexycodes/resticprofile-dockerfile/ to run resticprofile from a Docker container. I have created a pull request on that project that adds rclone to the build - alexycodes/resticprofile-dockerfile#1.

It would be good however, if resticprofile would allow env: in the child commands such as copy that would then ignore parent env: vars this allowing multiple AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY env vars to be specified.