Skip to content

Operations

This page covers running the transfer worker day to day: how it is secured, checking runs, logs, backups, updates and support.

Security model

  • No open ports. rclone does not listen on the network.
  • No stored keys. The configuration contains no access keys. For S3, the instance role provides short-lived credentials.
  • Copy only. The scripts never delete files on the destination, and rclone-copy.sh refuses any argument other than --dry-run.
  • Confined paths. The scripts refuse a source outside /var/lib/rclone/include, a local destination outside /var/lib/rclone/destination and a cache outside /var/lib/rclone/cache.
  • Least privilege. Copies run as the rclone user. The ubuntu user cannot read the configuration.
  • Service sandbox. The copy service can write only to /var/lib/rclone, and cannot see /home, /root or /run/user.

These path checks guard against mistakes. They are not a sandbox against someone who can already change files under /var/lib/rclone.

Check runs

systemctl list-timers rclone-copy.timer
systemctl status rclone-copy.service --no-pager
sudo -u rclone /opt/sushi/bin/rclone-check.sh

Logs

Each run logs to the systemd journal:

sudo journalctl -u rclone-copy.service -n 100 --no-pager
sudo journalctl -u sushi-rclone-firstboot --no-pager

Backups

  • A local destination lives on the instance's root volume, so it disappears with the instance. Use volume snapshots if it stays local.
  • An S3 destination survives the instance. Overwritten objects are not kept unless you turn on bucket versioning. The image configures no versioning, retention or second copy.
  • The source folder is on the root volume too. Snapshot it, or rely on the copy already in your bucket.

To move to a replacement instance, launch it, copy /etc/rclone/rclone.conf and /etc/rclone/rclone.env if you edited them, attach an IAM role you create for that instance, and run a copy into an empty prefix first.

Updates

  • Ubuntu packages receive unattended security updates.
  • rclone itself is a pinned binary and is not updated by apt. A new rclone release comes as a new version of the image. Running instances are not migrated: launch the new version and move across as above.

Support

Software Sushi supports the packaging, first-boot setup and this documentation. Email info@softwaresushi.com with the output of rclone version, what you ran and the error. Never include credentials. Support coverage beyond installation questions requires a separate agreement. The rclone project does not provide support for this image.