Repositories should better be associated to a profile

[kelson42]

Something really bad (from a security poin of view) happened to me.

I manage backups of multiple organisations via multiple profiles in Vorta.

Unfortunately, it came to the situation where backups from one organisation went to an other.

I believe this happened because the listbox of repositories includes all the repositories (independently of the current profile).

I probably have changed inadvertantly the repository wrongly (there is no userfriendly label and no "save" button either) in a profile and then the schedule made the rest.

To my opinion, we have here a usability weakness which can lead to a really concerning security issue.

[real-yfprojects]

I find it hard to imagine how you managed to pull this off because changing a repository unnoticed seems fairly difficult to me. But we'll keep this issue in mind in case the GUI is changed at some point.

there is no userfriendly label

What do you mean by that?

[kelson42]

I find it hard to imagine how you managed to pull this off because changing a repository unnoticed seems fairly difficult to me. But we'll keep this issue in mind in case the GUI is changed at some point.

@real-yfprojects AFAIK backuping content in another repository is as easy as changing "Repository" value using the selectbox, see:

This is super easy and there is no second validation/warning of any sort. Considering that pulling down this select box seems to be the only way to list the repositories configured in Vorta, this can really happen inadvertently. With such an easy move, you can leak inadvertanly the full backup of a machine to a 100% external entity.... and you won't remark it quickly probably.

there is no userfriendly label

What do you mean by that?

At borgbase, here is how a repository looks like for example adt5q23r@adt5q23r.repo.borgbase.com:repo and I have many of them for many clients. To me, they all look the same, I have no way to know what is what easily and for sure not in Vorta. I have to go to BorgBase WebUI to see which user friendly label is attached to this machine generated repository name.

[real-yfprojects]

backuping content in another repository is as easy as changing "Repository" value using the selectbox

This is super easy and there is no second validation/warning of any sort.

I think that a click on a wrong entry doesn't go unnoticed. But if you have repo names as the ones from borgbase, I can imagine that one easily selects the wrong one.

I would therefore suggest splitting this issue up into two issues regarding

Considering that pulling down this select box seems to be the only way to list the repositories configured in Vorta.

and

At borgbase, here is how a repository looks like for example adt5q23r@adt5q23r.repo.borgbase.com:repo

[m3nu]

Would be simplest to just add a name field to each repo? Separate from the repo url. I agree that they are not very memorable and cant be changed for technical reasons.

There is another issue to associate multiple repos with one profile. So doing a backup to multiple target repos. This would be with checkboxes.

[stale]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.

[technimad]

As a new user I completely misunderstood the profile repository association. I expected the repositories to be linked to a profile. Meaning the backups will be made to all repositories available in the profile, according to the schedule and sources.

Apparently only one repository can be linked to a profile. And there is no association between available repositories and the profile.

This can be better explained, and reflected in the UI.

[m3nu]

What change are you suggesting to better explain this?

[technimad]

What would have helped me: on the repository tab, change of "Repository: " to "Select a repository:".
Where "a repository" is a cue that one repository will be used.
Any other cue signalling the same would have helped as well; i.e. popup-hover text.

[real-yfprojects]

Where "a repository" is a cue that one repository will be used.

I suggest the wording Repository where the singular indicates that the backup will be made to a single, selected repository. Though I do see that this is not clear enough, especially with the add button that suggest one adds another repo to the current profile. Adding a tool-tip is a good idea.

[RubenKelevra]

I think the name "profile" could also be optimized: I think a naming these as “Backup Job” or something like that would be better.

From UI perspective:

A list on the left side with the "Backup Jobs" (profiles) would help to declutter the UI and enables that the list could show jobs are currently running. For example with an progress bar below the name and a stop button on the right.

A play button could also be shown, to instantly start a backup job.

If there's a planned backup, the time for the next job could be shown below.

[real-yfprojects]

A list on the left side with the "Backup Jobs" (profiles) would help to declutter the UI

I had this idea too. It is currently in the planning phase.