Backup and prune

Keep the central store healthy - run configured backups with ghostshell backup and delete old recordings interactively with prune.

Back up the key first

Before anything else: back up /var/lib/ghostshell/.ghostshell.key.

Warning: If the key is lost, every encrypted recording is permanently unreadable. The daemon refuses to start if the key is missing while encrypted recordings exist. See encryption and key immutability.

Backup

bash

sudo ghostshell backup

Runs the configured backup of the central store immediately, respecting the backup_type and backup_target settings in /etc/ghostshell/ghostshell.conf (see configuration).

Note: The deployment review verified the rsync backup path mirrors the store exactly (including deletions) and builds commands argv-only — no shell interpolation. Network backup types (rsync, bucket_aws, bucket_gcp) need a systemd drop-in adding AF_INET AF_INET6 to RestrictAddressFamilies, since the hardened unit restricts the daemon to Unix sockets by default. Backups are off by default, so this is never a day-one break.

Prune

ghostshell prune interactively deletes recordings by user and time. Pass --yes to skip the final confirmation in scripts.

console

$ sudo ghostshell prune Users with recordings: alice, root Prune which user? [all / <username>] alice What to delete: all every session for the selected user(s) days N sessions older than N days range FROM TO sessions started in [FROM, TO] Selection? days 90 Will delete 4 session(s), 2.1 MiB total: alice/20260101T...cast ... Delete these 4 session(s)? [yes/NO] yes pruned 4 session(s), freed 2.1 MiB

The selection grammar:

Selection	Deletes
`all`	Every session for the selected user(s)
`days N`	Sessions older than N days
`range FROM TO`	Sessions started in `[FROM, TO]`

Note: If a prune password is configured, it gates deletion separately from the playback password — see the security model. Reported sizes are on-disk (encrypted) sizes, so "freed" matches what df gives back.

Recordings live in per-user directories under /var/lib/ghostshell — see audit mode for the layout.

Source of truth: README on GitHub