[supertj]

Overview

Adds a shell plugin for backupdrill, the open-source CLI that backs up a Supabase project (the Postgres database and, optionally, Storage files) to an S3-compatible bucket, and can restore a backup into a throwaway Postgres to check it. Source: https://github.com/backupdrill/cli. I'm one of the BackupDrill maintainers.

The CLI has no login step. It reads the source database connection string and the bucket keys from BACKUPDRILL_* environment variables, so in practice they end up exported in a shell profile or pasted into a config file. This plugin provisions them from one 1Password item instead.

Field	Environment variable	Required
Access Key ID	BACKUPDRILL_S3_ACCESS_KEY_ID	yes
Secret Access Key	BACKUPDRILL_S3_SECRET_ACCESS_KEY	yes
Bucket	BACKUPDRILL_S3_BUCKET	no
Endpoint	BACKUPDRILL_S3_ENDPOINT	no
Region	BACKUPDRILL_S3_REGION	no
Database URL	BACKUPDRILL_DATABASE_URL	no
Supabase Storage Endpoint	BACKUPDRILL_SUPABASE_STORAGE_ENDPOINT	no
Supabase Storage Region	BACKUPDRILL_SUPABASE_STORAGE_REGION	no
Supabase Storage Access Key ID	BACKUPDRILL_SUPABASE_STORAGE_ACCESS_KEY_ID	no
Supabase Storage Secret Access Key	BACKUPDRILL_SUPABASE_STORAGE_SECRET_ACCESS_KEY	no

The variable names come from src/config.ts in the CLI and match https://backupdrill.com/docs/cli#configure.

Some notes for review:

• Only the bucket keys are required. drill, restore and exporter work without the database URL, so a machine that only runs drills can use an item that doesn't hold the database password. backup and estimate exit with Missing required config: databaseUrl (BACKUPDRILL_DATABASE_URL) if it's missing.
• Fields that aren't in the item aren't set at all. The CLI resolves flags first, then env vars, then backupdrill.config.json, so whatever is in the config file still applies.
• No file importer. The config file lives in each project directory (or wherever --config points), so there's no fixed path to scan. The env var importer covers the documented setup.
• BACKUPDRILL_TARGET_DATABASE_URL and BACKUPDRILL_TARGET_SERVICE_ROLE_KEY are left out on purpose. They belong to the fresh project you restore into, not the one being backed up, and the CLI already asks for them with a hidden prompt when they aren't set.

Type of change

• Created a new plugin
• Improved an existing plugin
• Fixed a bug in an existing plugin
• Improved contributor utilities or experience

Related Issue(s)

None.

How To Test

Install the CLI with npm install -g backupdrill (2.6.0), then create an item with at least the bucket keys, the bucket name and the database URL (add Endpoint for R2 or B2):

op plugin init backupdrill
backupdrill estimate --plan free
backupdrill backup

estimate is read-only: it connects to the database and prints its size. backup also needs pg_dump with a major version at least as new as the server's.

backupdrill --help, backupdrill help drill and backupdrill -V run without asking for authentication.

Locally, make backupdrill/validate passes every check, make test and make validate pass, and golangci-lint v2.12.2 reports 0 issues.

Changelog

Authenticate the BackupDrill CLI using Touch ID and other unlock options with 1Password Shell Plugins.