Merge branch 'master' into ai-testing

Bumps golang from 1.24-alpine to 1.25-alpine.

---
updated-dependencies:
- dependency-name: golang
  dependency-version: 1.25-alpine
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>

.github/workflows/build.yml

@@ -1,21 +1,19 @@
-name: Main
+name: Release
 
 on:
   push:
     tags:
-      - 'v*.*.*'
+      - "v*.*.*"
 
 jobs:
   docker:
     runs-on: ubuntu-latest
     steps:
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-      - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v2
+      - uses: docker/setup-qemu-action@v4
+      - uses: docker/setup-buildx-action@v4
       - name: Docker Labels
         id: meta
-        uses: crazy-max/ghaction-docker-meta@v4
+        uses: docker/metadata-action@v6
         with:
           images: cupcakearmy/autorestic
           tags: |
@@ -23,12 +21,12 @@ jobs:
             type=semver,pattern={{major}}.{{minor}}
             type=semver,pattern={{major}}
       - name: Login to DockerHub
-        uses: docker/login-action@v2
+        uses: docker/login-action@v4
         with:
           username: ${{ secrets.DOCKERHUB_USERNAME }}
           password: ${{ secrets.DOCKERHUB_TOKEN }}
       - name: Build and push
-        uses: docker/build-push-action@v3
+        uses: docker/build-push-action@v6
         with:
           platforms: linux/amd64,linux/arm64
           push: true
@@ -37,10 +35,9 @@ jobs:
   release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v3
-      - uses: actions/setup-go@v3
-        with:
-          go-version: '^1.21'
+      - uses: actions/checkout@v6
+      - uses: jdx/mise-action@v3
+      - run: mise run build
       - name: Build
         run: go run build/build.go
       - name: Release

.github/workflows/ci.yml

@@ -0,0 +1,29 @@
+name: CI
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - master
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: true
+
+env:
+  MISE_EXPERIMENTAL: true
+
+jobs:
+  test:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: jdx/mise-action@v3
+      - run: mise run test
+
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: jdx/mise-action@v3
+      - run: mise run build

.gitignore

@@ -10,3 +10,4 @@ test
 autorestic
 data
 dist
+coverage*

Dockerfile

@@ -1,4 +1,4 @@
-FROM golang:1.21-alpine as builder
+FROM golang:1.25-alpine as builder
 
 WORKDIR /app
 COPY go.* .
@@ -6,8 +6,8 @@ RUN go mod download
 COPY . .
 RUN go build
 
-FROM restic/restic:0.16.4
-RUN apk add --no-cache rclone bash curl
+FROM restic/restic:0.17.3
+RUN apk add --no-cache rclone bash curl docker-cli
 COPY --from=builder /app/autorestic /usr/bin/autorestic
 ENTRYPOINT []
 CMD [ "autorestic" ]

README.md

@@ -34,7 +34,7 @@ Autorestic is a wrapper around the amazing [restic](https://restic.net/). While
 - Backup locations to multiple backends
 - Snapshot policies and pruning
 - Fully encrypted
-- Pre/After hooks
+- Before/after backup hooks
 - Exclude pattern/files
 - Cron jobs for automatic backup
 - Backup & Restore docker volume

cmd/backup.go

@@ -18,9 +18,11 @@ var backupCmd = &cobra.Command{
 		err := lock.Lock()
 		CheckErr(err)
 		defer lock.Unlock()
+		dry, _ := cmd.Flags().GetBool("dry-run")
 
 		selected, err := internal.GetAllOrSelected(cmd, false)
 		CheckErr(err)
+
 		errors := 0
 		for _, name := range selected {
 			var splitted = strings.Split(name, "@")
@@ -29,7 +31,7 @@ var backupCmd = &cobra.Command{
 				specificBackend = splitted[1]
 			}
 			location, _ := internal.GetLocation(splitted[0])
-			errs := location.Backup(false, specificBackend)
+			errs := location.Backup(false, dry, specificBackend)
 			for _, err := range errs {
 				colors.Error.Printf("%s\n\n", err)
 				errors++
@@ -44,4 +46,5 @@ var backupCmd = &cobra.Command{
 func init() {
 	rootCmd.AddCommand(backupCmd)
 	internal.AddFlagsToCommand(backupCmd, false)
+	backupCmd.Flags().Bool("dry-run", false, "do not write changes, show what would be affected")
 }

cmd/unlock.go

@@ -0,0 +1,81 @@
+package cmd
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+	"strings"
+
+	"github.com/cupcakearmy/autorestic/internal"
+	"github.com/cupcakearmy/autorestic/internal/colors"
+	"github.com/cupcakearmy/autorestic/internal/lock"
+	"github.com/spf13/cobra"
+)
+
+var unlockCmd = &cobra.Command{
+	Use:   "unlock",
+	Short: "Unlock autorestic only if you are sure that no other instance is running",
+	Long: `Unlock autorestic only if you are sure that no other instance is running.
+To check you can run "ps aux | grep autorestic".`,
+	Run: func(cmd *cobra.Command, args []string) {
+		internal.GetConfig()
+
+		force, _ := cmd.Flags().GetBool("force")
+
+		if !force && isAutoresticRunning() {
+			colors.Error.Print("Another autorestic instance is running. Are you sure you want to unlock? (yes/no): ")
+			var response string
+			fmt.Scanln(&response)
+			if strings.ToLower(response) != "yes" {
+				colors.Primary.Println("Unlocking aborted.")
+				return
+			}
+		}
+
+		err := lock.Unlock()
+		if err != nil {
+			colors.Error.Println("Could not unlock:", err)
+			return
+		}
+
+		colors.Success.Println("Unlock successful")
+	},
+}
+
+func init() {
+	rootCmd.AddCommand(unlockCmd)
+	unlockCmd.Flags().Bool("force", false, "force unlock")
+}
+
+// isAutoresticRunning checks if autorestic is running
+// and returns true if it is.
+// It also prints the processes to stdout.
+func isAutoresticRunning() bool {
+	cmd := exec.Command("sh", "-c", "ps aux | grep autorestic")
+	var out bytes.Buffer
+	cmd.Stdout = &out
+	err := cmd.Run()
+	if err != nil {
+		return false
+	}
+
+	lines := strings.Split(out.String(), "\n")
+	autoresticProcesses := []string{}
+	currentPid := fmt.Sprint(os.Getpid())
+
+	for _, line := range lines {
+		if strings.Contains(line, "autorestic") && !strings.Contains(line, "grep autorestic") && !strings.Contains(line, currentPid) {
+			autoresticProcesses = append(autoresticProcesses, line)
+		}
+	}
+
+	if len(autoresticProcesses) > 0 {
+		colors.Faint.Println("Found autorestic processes:")
+		for _, proc := range autoresticProcesses {
+			colors.Faint.Println(proc)
+		}
+		return true
+	}
+	return false
+}

docs/.nvmrc

@@ -1 +1 @@
-v20.8.0
+v24

docs/mise.toml

@@ -0,0 +1,2 @@
+[settings]
+idiomatic_version_file_enable_tools = ["node", "pnpm"]

docs/package.json

@@ -1,14 +1,15 @@
 {
   "scripts": {
     "build": "NEXT_TELEMETRY_DISABLED=1 next build",
-    "dev": "NEXT_TELEMETRY_DISABLED=1 next"
+    "dev": "NEXT_TELEMETRY_DISABLED=1 next",
+    "start": "NEXT_TELEMETRY_DISABLED=1 next start"
   },
   "dependencies": {
-    "next": "^13.5.3",
-    "nextra": "^2.13.1",
-    "nextra-theme-docs": "^2.13.1",
-    "react": "^18.2.0",
-    "react-dom": "^18.2.0"
+    "next": "^14.2.35",
+    "nextra": "^2.13.4",
+    "nextra-theme-docs": "^2.13.4",
+    "react": "^18.3.1",
+    "react-dom": "^18.3.1"
   },
-  "packageManager": "pnpm@8.8.0"
+  "packageManager": "pnpm@10.33.0"
 }

docs/pages/backend/index.md

@@ -16,3 +16,25 @@ backends:
 ## Types
 
 We restic supports multiple types of backends. See the [full list](/backend/available) for details.
+
+## Avoid Generating Keys
+
+By default, `autorestic` will generate a key for every backend if none is defined. This is done by updating your config file with the key.
+
+In cases where you want to provide the key yourself, you can ensure that `autorestic` doesn't accidentally generate one for you by setting `requireKey: true`.
+
+Example:
+
+```yaml | .autorestic.yml
+version: 2
+
+backends:
+  foo:
+    type: local
+    path: /data/my/backups
+    # Alternatively, you can set the key through the `AUTORESTIC_FOO_RESTIC_PASSWORD` environment variable.
+    key: ... your key here ...
+    requireKey: true
+```
+
+With this setting, if a key is missing, `autorestic` will crash instead of generating a new key and updating your config file.

docs/pages/cli/backup.md

@@ -1,11 +1,14 @@
 # Backup
 
 ```bash
-autorestic backup [-l, --location] [-a, --all]
+autorestic backup [-l, --location] [-a, --all] [--dry-run]
 ```
 
 Performs a backup of all locations if the `-a` flag is passed. To only backup some locations pass one or more `-l` or `--location` flags.
 
+The `--dry-run` flag will do a dry run showing what would have been deleted, but won't touch the actual data.
+
+
 ```bash
 # All
 autorestic backup -a

docs/pages/cli/unlock.md

@@ -0,0 +1,32 @@
+# Unlock
+
+In case autorestic throws the error message `an instance is already running. exiting`, but there is no instance running you can unlock the lock.
+
+To verify that there is no instance running you can use `ps aux | grep autorestic`.
+
+Example with no instance running:
+
+```bash
+> ps aux | grep autorestic
+root       39260  0.0  0.0   6976  2696 pts/11   S+   19:41   0:00 grep autorestic
+```
+
+Example with an instance running:
+
+```bash
+> ps aux | grep autorestic
+root       29465  0.0  0.0 1162068 7380 pts/7    Sl+  19:28   0:00 autorestic --ci backup -a
+root       39260  0.0  0.0   6976  2696 pts/11   S+   19:41   0:00 grep autorestic
+```
+
+**If an instance is running you should not unlock as it could lead to data loss!**
+
+```bash
+autorestic unlock
+```
+
+Use the `--force` to prevent the confirmation prompt if an instance is running.
+
+```bash
+autorestic unlock --force
+```

docs/pages/community.md

@@ -1,5 +1,7 @@
 # 🏘 Community
 
+## Software
+
 A list of community driven projects. (No official affiliation)
 
 - SystemD Units: <https://gitlab.com/py_crash/autorestic-systemd-units>
@@ -9,3 +11,7 @@ A list of community driven projects. (No official affiliation)
 - Ansible Role: <https://github.com/FuzzyMistborn/ansible-role-autorestic>
 - Ansible Role: <https://0xacab.org/varac-projects/ansible-role-autorestic>
 - Ansible Role: <https://github.com/dbrennand/ansible-role-autorestic>
+
+## Writing
+
+- [restic: excellent resource for local and cloud backup](https://notes.nicfab.eu/en/posts/restic/)

docs/pages/config.md

@@ -56,6 +56,8 @@ version: 2
 
 extras:
   hooks: &foo
+    prevalidate:
+      - echo "Wake up!"
     before:
       - echo "Hello"
     after:

docs/pages/index.md

@@ -13,7 +13,7 @@ Autorestic is a wrapper around the amazing [restic](https://restic.net/). While
 - Backup locations to multiple backends
 - Snapshot policies and pruning
 - Fully encrypted
-- Pre/After hooks
+- Before/after backup hooks
 - Exclude pattern/files
 - Cron jobs for automatic backup
 - Backup & Restore docker volumes

docs/pages/location/docker.md

@@ -18,7 +18,7 @@ services:
 
 ```yaml | .autorestic.yml
 locations:
-  foo:
+  hello:
     from: my-data
     type: volume
     # ...

docs/pages/location/hooks.md

@@ -6,23 +6,28 @@ They consist of a list of commands that will be executed in the same directory a
 
 The following hooks groups are supported, none are required:
 
+- `prevalidate`
 - `before`
 - `after`
 - `failure`
 - `success`
 
+The difference between `prevalidate` and `before` hooks are that `prevalidate` is run before checking the backup location is valid, including checking that the `from` directories exist. This can be useful, for example, to mount the source filesystem that contains the directories listed in `from`.
+
 ```yml | .autorestic.yml
 locations:
   my-location:
     from: /data
     to: my-backend
     hooks:
+      prevalidate:
+        - echo "Checks"
       before:
         - echo "One"
         - echo "Two"
         - echo "Three"
       after:
-        - echo "Byte"
+        - echo "Bye"
       failure:
         - echo "Something went wrong"
       success:
@@ -31,13 +36,15 @@ locations:
 
 ## Flowchart
 
-1. `before` hook
-2. Run backup
-3. `after` hook
-4. - `success` hook if no errors were found
+1. `prevalidate` hook
+2. Check backup location
+3. `before` hook
+4. Run backup
+5. `after` hook
+6. - `success` hook if no errors were found
    - `failure` hook if at least one error was encountered
 
-If the `before` hook encounters errors the backup and `after` hooks will be skipped and only the `failed` hooks will run.
+If either the `prevalidate` or `before` hook encounters errors then the backup and `after` hooks will be skipped and only the `failed` hooks will run.
 
 ## Environment variables
 

go.mod

@@ -1,6 +1,6 @@
 module github.com/cupcakearmy/autorestic
 
-go 1.21
+go 1.26.1
 
 require (
 	github.com/blang/semver/v4 v4.0.0
@@ -11,9 +11,11 @@ require (
 	github.com/robfig/cron v1.2.0
 	github.com/spf13/cobra v1.4.0
 	github.com/spf13/viper v1.11.0
+	github.com/stretchr/testify v1.9.0
 )
 
 require (
+	github.com/davecgh/go-spew v1.1.1 // indirect
 	github.com/fsnotify/fsnotify v1.5.1 // indirect
 	github.com/hashicorp/hcl v1.0.0 // indirect
 	github.com/inconshreveable/mousetrap v1.0.0 // indirect
@@ -23,6 +25,7 @@ require (
 	github.com/mitchellh/mapstructure v1.4.3 // indirect
 	github.com/pelletier/go-toml v1.9.4 // indirect
 	github.com/pelletier/go-toml/v2 v2.0.0-beta.8 // indirect
+	github.com/pmezard/go-difflib v1.0.0 // indirect
 	github.com/spf13/afero v1.8.2 // indirect
 	github.com/spf13/cast v1.4.1 // indirect
 	github.com/spf13/jwalterweatherman v1.1.0 // indirect
@@ -32,5 +35,5 @@ require (
 	golang.org/x/text v0.3.8 // indirect
 	gopkg.in/ini.v1 v1.66.4 // indirect
 	gopkg.in/yaml.v2 v2.4.0 // indirect
-	gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b // indirect
+	gopkg.in/yaml.v3 v3.0.1 // indirect
 )

go.sum

@@ -182,8 +182,9 @@ github.com/stretchr/testify v1.2.2/go.mod h1:a8OnRcib4nhh0OaRAV+Yts87kKdq0PP7pXf
 github.com/stretchr/testify v1.4.0/go.mod h1:j7eGeouHqKxXV5pUuKE4zz7dFj8WfuZ+81PSLYec5m4=
 github.com/stretchr/testify v1.5.1/go.mod h1:5W2xD1RspED5o8YsWQXVCued0rvSQ+mT+I5cxcmMvtA=
 github.com/stretchr/testify v1.7.0/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
-github.com/stretchr/testify v1.7.1 h1:5TQK59W5E3v0r2duFAb7P95B6hEeOyEnHRa8MjYSMTY=
 github.com/stretchr/testify v1.7.1/go.mod h1:6Fq8oRcR53rry900zMqJjRRixrwX3KX962/h/Wwjteg=
+github.com/stretchr/testify v1.9.0 h1:HtqpIVDClZ4nwg75+f6Lvsy/wHu+3BoSGCbBAcpTsTg=
+github.com/stretchr/testify v1.9.0/go.mod h1:r2ic/lqez/lEtzL7wO/rwa5dbSLXVDPFyf8C91i36aY=
 github.com/subosito/gotenv v1.2.0 h1:Slr1R9HxAlEKefgq5jn9U+DnETlIUa6HfgEzj0g5d7s=
 github.com/subosito/gotenv v1.2.0/go.mod h1:N0PQaV/YGNqwC0u51sEeR/aUtSLEXKX9iv69rRypqCw=
 github.com/yuin/goldmark v1.1.25/go.mod h1:3hX8gzYuyVAZsxl0MRgGTJEmQBFcNTphYh9decYSb74=
@@ -487,8 +488,8 @@ gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1VGuI=
 gopkg.in/yaml.v2 v2.4.0 h1:D8xgwECY7CYvx+Y2n4sBz93Jn9JRvxdiyyo8CTfuKaY=
 gopkg.in/yaml.v2 v2.4.0/go.mod h1:RDklbk79AGWmwhnvt/jBztapEOGDOx6ZbXqjP6csGnQ=
 gopkg.in/yaml.v3 v3.0.0-20200313102051-9f266ea9e77c/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b h1:h8qDotaEPuJATrMmW04NCwg7v22aHH28wwpauUhK9Oo=
-gopkg.in/yaml.v3 v3.0.0-20210107192922-496545a6307b/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
+gopkg.in/yaml.v3 v3.0.1 h1:fxVm/GzAzEWqLHuvctI91KS9hhNmmWOoWu0XTYJS7CA=
+gopkg.in/yaml.v3 v3.0.1/go.mod h1:K4uyk7z7BCEPqu6E+C64Yfv1cQ7kz7rIZviUmN+EgEM=
 honnef.co/go/tools v0.0.0-20190102054323-c2f93a96b099/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190106161140-3f1c8253044a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=
 honnef.co/go/tools v0.0.0-20190418001031-e561f6794a2a/go.mod h1:rf3lG4BRIbNafJWhAfAdb/ePZxsR/4RtNHQocxwk9r4=

install.sh

@@ -1,5 +1,5 @@
 #!/bin/bash
-
+set -e -o pipefail
 shopt -s nocaseglob
 
 OUT_FILE=/usr/local/bin/autorestic
@@ -10,6 +10,8 @@ if [[ $NATIVE_OS == *"linux"* ]]; then
     OS=linux
 elif [[ $NATIVE_OS == *"darwin"* ]]; then
     OS=darwin
+elif [[ $NATIVE_OS == *"freebsd"* ]]; then
+    OS=freebsd
 else
     echo "Could not determine OS automatically, please check the release page manually: https://github.com/cupcakearmy/autorestic/releases"
     exit 1
@@ -17,7 +19,7 @@ fi
 echo $OS
 
 NATIVE_ARCH=$(uname -m | tr '[:upper:]' '[:lower:]')
-if [[ $NATIVE_ARCH == *"x86_64"* ]]; then
+if [[ $NATIVE_ARCH == *"x86_64"* || $NATIVE_ARCH == *"amd64"* ]]; then
     ARCH=amd64
 elif [[ $NATIVE_ARCH == *"arm64"* || $NATIVE_ARCH == *"aarch64"* ]]; then
     ARCH=arm64

internal/backend.go

@@ -6,6 +6,7 @@ import (
 	"fmt"
 	"net/url"
 	"os"
+	"regexp"
 	"strings"
 
 	"github.com/cupcakearmy/autorestic/internal/colors"
@@ -13,18 +14,19 @@ import (
 )
 
 type BackendRest struct {
-	User     string `mapstructure:"user,omitempty"`
-	Password string `mapstructure:"password,omitempty"`
+	User     string `mapstructure:"user,omitempty" yaml:"user,omitempty"`
+	Password string `mapstructure:"password,omitempty" yaml:"password,omitempty"`
 }
 
 type Backend struct {
 	name       string
-	Type    string            `mapstructure:"type,omitempty"`
-	Path    string            `mapstructure:"path,omitempty"`
-	Key     string            `mapstructure:"key,omitempty"`
-	Env     map[string]string `mapstructure:"env,omitempty"`
-	Rest    BackendRest       `mapstructure:"rest,omitempty"`
-	Options Options           `mapstructure:"options,omitempty"`
+	Type       string            `mapstructure:"type,omitempty" yaml:"type,omitempty"`
+	Path       string            `mapstructure:"path,omitempty" yaml:"path,omitempty"`
+	Key        string            `mapstructure:"key,omitempty" yaml:"key,omitempty"`
+	RequireKey bool              `mapstructure:"requireKey,omitempty" yaml:"requireKey,omitempty"`
+	Env        map[string]string `mapstructure:"env,omitempty" yaml:"env,omitempty"`
+	Rest       BackendRest       `mapstructure:"rest,omitempty" yaml:"rest,omitempty"`
+	Options    Options           `mapstructure:"options,omitempty" yaml:"options,omitempty"`
 }
 
 func GetBackend(name string) (Backend, bool) {
@@ -57,6 +59,8 @@ func (b Backend) generateRepo() (string, error) {
 	}
 }
 
+var nonAlphaRegex = regexp.MustCompile("[^A-Za-z0-9]")
+
 func (b Backend) getEnv() (map[string]string, error) {
 	env := make(map[string]string)
 	// Key
@@ -72,7 +76,9 @@ func (b Backend) getEnv() (map[string]string, error) {
 	}
 
 	// From Envfile and passed as env
-	var prefix = "AUTORESTIC_" + strings.ToUpper(b.name) + "_"
+	nameForEnv := strings.ToUpper(b.name)
+	nameForEnv = nonAlphaRegex.ReplaceAllString(nameForEnv, "_")
+	var prefix = "AUTORESTIC_" + nameForEnv + "_"
 	for _, variable := range os.Environ() {
 		var splitted = strings.SplitN(variable, "=", 2)
 		if strings.HasPrefix(splitted[0], prefix) {
@@ -104,6 +110,9 @@ func (b Backend) validate() error {
 		// Check if key is set in environment
 		env, _ := b.getEnv()
 		if _, found := env["RESTIC_PASSWORD"]; !found {
+			if b.RequireKey {
+				return fmt.Errorf("backend %s requires a key but none was provided", b.name)
+			}
 			// No key set in config file or env => generate random key and save file
 			key := generateRandomKey()
 			b.Key = key
@@ -143,6 +152,7 @@ func (b Backend) Exec(args []string) error {
 		return err
 	}
 	options := ExecuteOptions{Envs: env}
+	args = append(args, combineBackendOptions("exec", b)...)
 	_, out, err := ExecuteResticCommand(options, args...)
 	if err != nil {
 		colors.Error.Println(out)
@@ -182,6 +192,7 @@ func (b Backend) ExecDocker(l Location, args []string) (int, string, error) {
 	case "s3":
 	case "azure":
 	case "gs":
+	case "rest":
 		// No additional setup needed
 	case "rclone":
 		// Read host rclone config and mount it into the container

internal/backend_test.go

@@ -6,6 +6,7 @@ import (
 	"testing"
 
 	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestGenerateRepo(t *testing.T) {
@@ -194,6 +195,33 @@ func TestGetEnv(t *testing.T) {
 		assertEqual(t, result["B2_ACCOUNT_ID"], "foo123")
 		assertEqual(t, result["B2_ACCOUNT_KEY"], "foo456")
 	})
+
+	for _, char := range "@-_:/" {
+		t.Run(fmt.Sprintf("env var with special char (%c)", char), func(t *testing.T) {
+			// generate env variables
+			// TODO better way to teardown
+			defer os.Unsetenv("AUTORESTIC_FOO_BAR_RESTIC_PASSWORD")
+			defer os.Unsetenv("AUTORESTIC_FOO_BAR_B2_ACCOUNT_ID")
+			defer os.Unsetenv("AUTORESTIC_FOO_BAR_B2_ACCOUNT_KEY")
+			os.Setenv("AUTORESTIC_FOO_BAR_RESTIC_PASSWORD", "secret123")
+			os.Setenv("AUTORESTIC_FOO_BAR_B2_ACCOUNT_ID", "foo123")
+			os.Setenv("AUTORESTIC_FOO_BAR_B2_ACCOUNT_KEY", "foo456")
+
+			b := Backend{
+				name: fmt.Sprintf("foo%cbar", char),
+				Type: "local",
+				Path: "/foo/bar",
+			}
+			result, err := b.getEnv()
+			if err != nil {
+				t.Errorf("unexpected error %v", err)
+			}
+			assertEqual(t, result["RESTIC_REPOSITORY"], "/foo/bar")
+			assertEqual(t, result["RESTIC_PASSWORD"], "secret123")
+			assertEqual(t, result["B2_ACCOUNT_ID"], "foo123")
+			assertEqual(t, result["B2_ACCOUNT_KEY"], "foo456")
+		})
+	}
 }
 
 func TestValidate(t *testing.T) {
@@ -222,4 +250,16 @@ func TestValidate(t *testing.T) {
 		}
 		assertEqual(t, err.Error(), "Backend \"foo\" has no \"path\"")
 	})
+
+	t.Run("require key with no key", func(t *testing.T) {
+		b := Backend{
+			name:       "foo",
+			Type:       "local",
+			Path:       "~/foo/bar",
+			RequireKey: true,
+		}
+		err := b.validate()
+		fmt.Printf("error: %v\n", err)
+		assert.EqualError(t, err, "backend foo requires a key but none was provided")
+	})
 }

internal/bins/bins.go

@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"net/http"
 	"os"
 	"path"
@@ -37,7 +36,7 @@ func dlJSON(url string) (GithubRelease, error) {
 		return parsed, err
 	}
 	defer resp.Body.Close()
-	body, err := ioutil.ReadAll(resp.Body)
+	body, err := io.ReadAll(resp.Body)
 	if err != nil {
 		return parsed, err
 
@@ -73,9 +72,10 @@ func downloadAndInstallAsset(body GithubRelease, name string) error {
 			// Uncompress
 			bz := bzip2.NewReader(resp.Body)
 
-			// Save to tmp
-			// Linux does not support overwriting the file that is currently being overwritten, but it can be deleted and a new one moved in its place.
-			tmp, err := ioutil.TempFile(os.TempDir(), "autorestic-")
+			// Save to tmp file in the same directory as the install directory
+			// Linux does not support overwriting the file that is currently being running
+			// But it can be delete the old one and a new one moved in its place.
+			tmp, err := os.CreateTemp(INSTALL_PATH, "autorestic-")
 			if err != nil {
 				return err
 			}
@@ -89,23 +89,25 @@ func downloadAndInstallAsset(body GithubRelease, name string) error {
 
 			to := path.Join(INSTALL_PATH, name)
 			defer os.Remove(tmp.Name()) // Cleanup temporary file after thread exits
-			if err := os.Rename(tmp.Name(), to); err != nil {
-				colors.Error.Printf("os.Rename() failed (%v), retrying with io.Copy()\n", err.Error())
-				var src *os.File
-				var dst *os.File
-				if src, err = os.Open(tmp.Name()); err != nil {
+
+			mode := os.FileMode(0755)
+			if originalBin, err := os.Lstat(to); err == nil {
+				mode = originalBin.Mode()
+				err := os.Remove(to)
+				if err != nil {
 					return err
 				}
-				if dst, err = os.Create(to); err != nil {
+			}
+
+			err = os.Rename(tmp.Name(), to)
+			if err != nil {
 				return err
 			}
-				if _, err := io.Copy(dst, src); err != nil {
+
+			err = os.Chmod(to, mode)
+			if err != nil {
 				return err
 			}
-				if err := os.Chmod(to, 0755); err != nil {
-					return err
-				}
-			}
 
 			colors.Success.Printf("Successfully installed '%s' under %s\n", name, INSTALL_PATH)
 			return nil

internal/config.go

@@ -17,17 +17,17 @@ import (
 	"github.com/spf13/viper"
 )
 
-const VERSION = "1.7.11"
+const VERSION = "1.8.3"
 
 type OptionMap map[string][]interface{}
 type Options map[string]OptionMap
 
 type Config struct {
-	Version   string              `mapstructure:"version"`
-	Extras    interface{}         `mapstructure:"extras"`
-	Locations map[string]Location `mapstructure:"locations"`
-	Backends  map[string]Backend  `mapstructure:"backends"`
-	Global    Options             `mapstructure:"global"`
+	Version   string              `mapstructure:"version" yaml:"version"`
+	Extras    interface{}         `mapstructure:"extras" yaml:"extras"`
+	Locations map[string]Location `mapstructure:"locations" yaml:"locations"`
+	Backends  map[string]Backend  `mapstructure:"backends" yaml:"backends"`
+	Global    Options             `mapstructure:"global" yaml:"global"`
 }
 
 var once sync.Once
@@ -132,6 +132,7 @@ func (c *Config) Describe() {
 
 		tmp = ""
 		hooks := map[string][]string{
+			"PreValidate": l.Hooks.PreValidate,
 			"Before":      l.Hooks.Before,
 			"After":       l.Hooks.After,
 			"Failure":     l.Hooks.Failure,
@@ -187,15 +188,31 @@ func CheckConfig() error {
 	if !CheckIfResticIsCallable() {
 		return fmt.Errorf(`%s was not found. Install either with "autorestic install" or manually`, flags.RESTIC_BIN)
 	}
-	for name, backend := range c.Backends {
-		backend.name = name
-		if err := backend.validate(); err != nil {
+
+	cwd, _ := GetPathRelativeToConfig(".")
+	for name, location := range c.Locations {
+		location.name = name
+
+		// Hooks before location validation
+		options := ExecuteOptions{
+			Command: "bash",
+			Dir:     cwd,
+			Envs: map[string]string{
+				"AUTORESTIC_LOCATION": location.name,
+			},
+		}
+		if err := location.ExecuteHooks(location.Hooks.PreValidate, options); err != nil {
+			return err
+		}
+
+		if err := location.validate(); err != nil {
 			return err
 		}
 	}
-	for name, location := range c.Locations {
-		location.name = name
-		if err := location.validate(); err != nil {
+
+	for name, backend := range c.Backends {
+		backend.name = name
+		if err := backend.validate(); err != nil {
 			return err
 		}
 	}

internal/config_test.go

@@ -1,10 +1,15 @@
 package internal
 
 import (
+	"path"
 	"reflect"
 	"strconv"
 	"strings"
+	"sync"
 	"testing"
+
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
 )
 
 func TestOptionToString(t *testing.T) {
@@ -143,6 +148,48 @@ func TestGetOptionsMultipleKeys(t *testing.T) {
 	reflect.DeepEqual(result, expected)
 }
 
+func TestSaveConfigProducesReadableConfig(t *testing.T) {
+	workDir := t.TempDir()
+	viper.SetConfigFile(path.Join(workDir, ".autorestic.yml"))
+
+	// Required to appease the config reader
+	viper.Set("version", 2)
+
+	c := Config{
+		Version: "2",
+		Locations: map[string]Location{
+			"test": {
+				Type: "local",
+				name: "test",
+				From: []string{"in-dir"},
+				To:   []string{"test"},
+				// ForgetOption & ConfigOption have previously marshalled in a way that
+				// can't get read correctly
+				ForgetOption: "foo",
+				CopyOption:   map[string][]string{"foo": {"bar"}},
+			},
+		},
+		Backends: map[string]Backend{
+			"test": {
+				name: "test",
+				Type: "local",
+				Path: "backup-target",
+				Key:  "supersecret",
+			},
+		},
+	}
+
+	err := c.SaveConfig()
+	assert.NoError(t, err)
+
+	// Ensure we the config reading logic actually runs
+	config = nil
+	once = sync.Once{}
+	readConfig := GetConfig()
+	assert.NotNil(t, readConfig)
+	assert.Equal(t, c, *readConfig)
+}
+
 func assertEqual[T comparable](t testing.TB, result, expected T) {
 	t.Helper()
 

internal/cron.go

@@ -1,12 +1,22 @@
 package internal
 
+import (
+	"errors"
+	"fmt"
+)
+
 func RunCron() error {
 	c := GetConfig()
+	var errs []error
 	for name, l := range c.Locations {
 		l.name = name
 		if err := l.RunCron(); err != nil {
-			return err
+			errs = append(errs, err)
 		}
 	}
+
+	if len(errs) > 0 {
+		return fmt.Errorf("Encountered errors during cron process:\n%w", errors.Join(errs...))
+	}
 	return nil
 }

internal/location.go

@@ -1,6 +1,7 @@
 package internal
 
 import (
+	"errors"
 	"fmt"
 	"io/ioutil"
 	"os"
@@ -33,25 +34,26 @@ const (
 )
 
 type Hooks struct {
-	Dir     string    `mapstructure:"dir"`
-	Before  HookArray `mapstructure:"before,omitempty"`
-	After   HookArray `mapstructure:"after,omitempty"`
-	Success HookArray `mapstructure:"success,omitempty"`
-	Failure HookArray `mapstructure:"failure,omitempty"`
+	Dir         string    `mapstructure:"dir" yaml:"dir"`
+	PreValidate HookArray `mapstructure:"prevalidate,omitempty" yaml:"prevalidate,omitempty"`
+	Before      HookArray `mapstructure:"before,omitempty" yaml:"before,omitempty"`
+	After       HookArray `mapstructure:"after,omitempty" yaml:"after,omitempty"`
+	Success     HookArray `mapstructure:"success,omitempty" yaml:"success,omitempty"`
+	Failure     HookArray `mapstructure:"failure,omitempty" yaml:"failure,omitempty"`
 }
 
 type LocationCopy = map[string][]string
 
 type Location struct {
-	name         string               `mapstructure:",omitempty"`
-	From         []string             `mapstructure:"from,omitempty"`
-	Type         string               `mapstructure:"type,omitempty"`
-	To           []string             `mapstructure:"to,omitempty"`
-	Hooks        Hooks                `mapstructure:"hooks,omitempty"`
-	Cron         string               `mapstructure:"cron,omitempty"`
-	Options      Options              `mapstructure:"options,omitempty"`
-	ForgetOption LocationForgetOption `mapstructure:"forget,omitempty"`
-	CopyOption   LocationCopy         `mapstructure:"copy,omitempty"`
+	name         string               `mapstructure:",omitempty" yaml:",omitempty"`
+	From         []string             `mapstructure:"from,omitempty" yaml:"from,omitempty"`
+	Type         string               `mapstructure:"type,omitempty" yaml:"type,omitempty"`
+	To           []string             `mapstructure:"to,omitempty" yaml:"to,omitempty"`
+	Hooks        Hooks                `mapstructure:"hooks,omitempty" yaml:"hooks,omitempty"`
+	Cron         string               `mapstructure:"cron,omitempty" yaml:"cron,omitempty"`
+	Options      Options              `mapstructure:"options,omitempty" yaml:"options,omitempty"`
+	ForgetOption LocationForgetOption `mapstructure:"forget,omitempty" yaml:"forget,omitempty"`
+	CopyOption   LocationCopy         `mapstructure:"copy,omitempty" yaml:"copy,omitempty"`
 }
 
 func GetLocation(name string) (Location, bool) {
@@ -166,7 +168,7 @@ func (l Location) getLocationTags() string {
 	return buildTag("location", l.name)
 }
 
-func (l Location) Backup(cron bool, specificBackend string) []error {
+func (l Location) Backup(cron bool, dry bool, specificBackend string) []error {
 	var errors []error
 	var backends []string
 	colors.PrimaryPrint("  Backing up location \"%s\"  ", l.name)
@@ -184,12 +186,18 @@ func (l Location) Backup(cron bool, specificBackend string) []error {
 		},
 	}
 
+	// Hooks before location validation
+	if err := l.ExecuteHooks(l.Hooks.PreValidate, options); err != nil {
+		errors = append(errors, err)
+		goto after
+	}
+
 	if err := l.validate(); err != nil {
 		errors = append(errors, err)
 		goto after
 	}
 
-	// Hooks
+	// Hooks after location validation
 	if err := l.ExecuteHooks(l.Hooks.Before, options); err != nil {
 		errors = append(errors, err)
 		goto after
@@ -220,6 +228,9 @@ func (l Location) Backup(cron bool, specificBackend string) []error {
 		if cron {
 			cmd = append(cmd, "--tag", buildTag("cron"))
 		}
+		if dry {
+			cmd = append(cmd, "--dry-run")
+		}
 		cmd = append(cmd, "--tag", l.getLocationTags())
 		backupOptions := ExecuteOptions{
 			Envs: env,
@@ -289,12 +300,13 @@ func (l Location) Backup(cron bool, specificBackend string) []error {
 		}
 	}
 
-	// After hooks
+	// After backup hooks
 	if err := l.ExecuteHooks(l.Hooks.After, options); err != nil {
 		errors = append(errors, err)
 	}
 
 after:
+	// Success/failure hooks
 	var commands []string
 	var isSuccess = len(errors) == 0
 	if isSuccess {
@@ -438,7 +450,10 @@ func (l Location) RunCron() error {
 	now := time.Now()
 	if now.After(next) {
 		lock.SetCron(l.name, now.Unix())
-		l.Backup(true, "")
+		errs := l.Backup(true, false, "")
+		if len(errs) > 0 {
+			return fmt.Errorf("Failed to backup location \"%s\":\n%w", l.name, errors.Join(errs...))
+		}
 	} else {
 		if !flags.CRON_LEAN {
 			colors.Body.Printf("Skipping \"%s\", not due yet.\n", l.name)

internal/location_test.go

@@ -1,6 +1,14 @@
 package internal
 
-import "testing"
+import (
+	"os"
+	"path"
+	"sync"
+	"testing"
+
+	"github.com/spf13/viper"
+	"github.com/stretchr/testify/assert"
+)
 
 func TestGetType(t *testing.T) {
 
@@ -91,3 +99,46 @@ func TestBuildRestoreCommand(t *testing.T) {
 	expected := []string{"restore", "--target", "to", "--tag", "ar:location:foo", "snapshot", "options"}
 	assertSliceEqual(t, result, expected)
 }
+
+func TestLocationBackupWithMock(t *testing.T) {
+	// Backup original
+	originalExecutor := DefaultExecutor
+	defer func() { DefaultExecutor = originalExecutor }()
+
+	// Inject mock
+	mock := &MockExecutor{
+		ExecuteResticFunc: func(options ExecuteOptions, args ...string) (int, string, error) {
+			assert.Equal(t, "backup", args[0])
+			return 0, "success", nil
+		},
+	}
+	DefaultExecutor = mock
+
+	// Setup dummy config
+	workDir := t.TempDir()
+	configFile := path.Join(workDir, ".autorestic.yml")
+	err := os.WriteFile(configFile, []byte("version: 2"), 0644)
+	assert.NoError(t, err)
+
+	viper.Reset()
+	viper.SetConfigFile(configFile)
+	viper.Set("version", 2)
+	// Register test-backend
+	viper.Set("backends.test-backend.type", "local")
+	viper.Set("backends.test-backend.path", workDir)
+
+	config = nil
+	once = sync.Once{}
+
+	loc := Location{
+		name: "test-location",
+		To:   []string{"test-backend"},
+		From: []string{"/"},
+		Type: "local",
+	}
+
+	errs := loc.Backup(false, false, "")
+	if len(errs) != 0 {
+		t.Errorf("expected no error, got %v", errs)
+	}
+}

internal/mock_executor_test.go

@@ -0,0 +1,20 @@
+package internal
+
+type MockExecutor struct {
+	ExecuteFunc       func(options ExecuteOptions, args ...string) (int, string, error)
+	ExecuteResticFunc func(options ExecuteOptions, args ...string) (int, string, error)
+}
+
+func (m *MockExecutor) Execute(options ExecuteOptions, args ...string) (int, string, error) {
+	if m.ExecuteFunc != nil {
+		return m.ExecuteFunc(options, args...)
+	}
+	return 0, "", nil
+}
+
+func (m *MockExecutor) ExecuteRestic(options ExecuteOptions, args ...string) (int, string, error) {
+	if m.ExecuteResticFunc != nil {
+		return m.ExecuteResticFunc(options, args...)
+	}
+	return 0, "", nil
+}

internal/utils.go

@@ -39,7 +39,14 @@ func (w ColoredWriter) Write(p []byte) (n int, err error) {
 	return len(p), nil
 }
 
-func ExecuteCommand(options ExecuteOptions, args ...string) (int, string, error) {
+type Executor interface {
+	Execute(options ExecuteOptions, args ...string) (int, string, error)
+	ExecuteRestic(options ExecuteOptions, args ...string) (int, string, error)
+}
+
+type RealExecutor struct{}
+
+func (e *RealExecutor) Execute(options ExecuteOptions, args ...string) (int, string, error) {
 	cmd := exec.Command(options.Command, args...)
 	env := os.Environ()
 	for k, v := range options.Envs {
@@ -76,12 +83,22 @@ func ExecuteCommand(options ExecuteOptions, args ...string) (int, string, error)
 	return 0, out.String(), nil
 }
 
-func ExecuteResticCommand(options ExecuteOptions, args ...string) (int, string, error) {
+func (e *RealExecutor) ExecuteRestic(options ExecuteOptions, args ...string) (int, string, error) {
 	options.Command = flags.RESTIC_BIN
 	var c = GetConfig()
 	var optionsAsString = getOptions(c.Global, []string{"all"})
 	args = append(optionsAsString, args...)
-	return ExecuteCommand(options, args...)
+	return e.Execute(options, args...)
+}
+
+var DefaultExecutor Executor = &RealExecutor{}
+
+func ExecuteCommand(options ExecuteOptions, args ...string) (int, string, error) {
+	return DefaultExecutor.Execute(options, args...)
+}
+
+func ExecuteResticCommand(options ExecuteOptions, args ...string) (int, string, error) {
+	return DefaultExecutor.ExecuteRestic(options, args...)
 }
 
 func CopyFile(from, to string) error {

internal/utils_test.go

@@ -0,0 +1,27 @@
+package internal
+
+import (
+	"github.com/stretchr/testify/assert"
+	"testing"
+)
+
+func TestExecuteCommandWithMock(t *testing.T) {
+	// Backup original
+	originalExecutor := DefaultExecutor
+	defer func() { DefaultExecutor = originalExecutor }()
+
+	// Inject mock
+	mock := &MockExecutor{
+		ExecuteFunc: func(options ExecuteOptions, args ...string) (int, string, error) {
+			assert.Equal(t, "docker", options.Command)
+			return 0, "mock output", nil
+		},
+	}
+	DefaultExecutor = mock
+
+	code, out, err := ExecuteCommand(ExecuteOptions{Command: "docker"}, "info")
+
+	assert.NoError(t, err)
+	assert.Equal(t, 0, code)
+	assert.Equal(t, "mock output", out)
+}

mise.toml

@@ -0,0 +1,14 @@
+[tools]
+go = "latest"
+restic = "latest"
+
+[tasks]
+build = { description = "Build the project", run = "go build -v ." }
+
+test = { description = "Run tests", run = "go test -v ./..." }
+
+coverage = { description = "Generate coverage report", run = "go test -coverprofile=coverage.out ./... && go tool cover -func=coverage.out && go tool cover -html=coverage.out -o coverage.html", depends = [
+  "test"
+] }
+
+clean = { run = "rm -f coverage.*", description = "Clean up coverage files" }

tests/integration_test.go

@@ -0,0 +1,280 @@
+package integration_test
+
+import (
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/stretchr/testify/assert"
+)
+
+func runAutorestic(t *testing.T, dir string, configPath string, args ...string) string {
+	// Find project root dynamically
+	wd, err := os.Getwd()
+	assert.NoError(t, err)
+	root := filepath.Dir(wd)
+
+	mainGo := filepath.Join(root, "main.go")
+
+	// Get restic path from mise
+	resticPath := "/Users/cupcakearmy/.local/share/mise/installs/restic/0.18.1/restic"
+
+	// Convert configPath to absolute path
+	absConfigPath, err := filepath.Abs(configPath)
+	assert.NoError(t, err)
+
+	cmd := exec.Command("go", append([]string{"run", mainGo, "--restic-bin", resticPath, "-c", absConfigPath}, args...)...)
+
+	// Run from root to find go.mod
+	cmd.Dir = root
+
+	// Add mise path to environment and set dummy password
+	cmd.Env = os.Environ()
+	cmd.Env = append(cmd.Env, "PATH="+os.Getenv("PATH"))
+	cmd.Env = append(cmd.Env, "RESTIC_PASSWORD=password")
+
+	output, err := cmd.CombinedOutput()
+	// NOTE: We don't assert NoError here because tests might expect failures
+	return string(output)
+}
+
+func initRepo(t *testing.T, repoPath string) {
+	resticPath := "/Users/cupcakearmy/.local/share/mise/installs/restic/0.18.1/restic"
+	cmd := exec.Command(resticPath, "-r", repoPath, "init")
+	cmd.Env = append(os.Environ(), "RESTIC_PASSWORD=password")
+	output, err := cmd.CombinedOutput()
+	assert.NoError(t, err, string(output))
+}
+
+func TestAutoresticCheck(t *testing.T) {
+	tempDir := t.TempDir()
+
+	configContent := `
+version: 2
+locations:
+  my-data:
+    from: ` + tempDir + `
+    to: local
+backends:
+  local:
+    type: local
+    path: ` + filepath.Join(tempDir, "repo") + `
+    key: password
+`
+	configPath := filepath.Join(tempDir, "autorestic.yml")
+	err := os.WriteFile(configPath, []byte(configContent), 0644)
+	assert.NoError(t, err)
+
+	_ = runAutorestic(t, tempDir, configPath, "check")
+}
+
+func TestBackupRestore(t *testing.T) {
+	tempDir := t.TempDir()
+
+	// 1. Create a source file
+	sourceFile := "source.txt"
+	err := os.WriteFile(filepath.Join(tempDir, sourceFile), []byte("hello world"), 0644)
+	assert.NoError(t, err)
+
+	repoPath := filepath.Join(tempDir, "repo")
+	initRepo(t, repoPath)
+
+	configContent := `
+version: 2
+locations:
+  my-data:
+    from: 
+      - ` + sourceFile + `
+    to: local
+backends:
+  local:
+    type: local
+    path: ` + repoPath + `
+    key: password
+`
+	configPath := filepath.Join(tempDir, "autorestic.yml")
+	err = os.WriteFile(configPath, []byte(configContent), 0644)
+	assert.NoError(t, err)
+
+	// 2. Backup
+	output := runAutorestic(t, tempDir, configPath, "backup", "-l", "my-data")
+	assert.Contains(t, output, "Done")
+
+	// 3. Restore
+	restoreDir := filepath.Join(tempDir, "restore")
+	err = os.MkdirAll(restoreDir, 0755)
+	assert.NoError(t, err)
+	output = runAutorestic(t, tempDir, configPath, "restore", "-l", "my-data", "--to", restoreDir)
+	t.Logf("Restore output: %s", output)
+
+	// DEBUG: List files in restoreDir and subdirectories
+	err = filepath.Walk(restoreDir, func(path string, info os.FileInfo, err error) error {
+		if err != nil {
+			return err
+		}
+		t.Logf("Found: %s", path)
+		return nil
+	})
+	assert.NoError(t, err)
+
+	// 4. Verify
+	// It might be nested depending on how it was backed up
+	// Let's look for source.txt in any subdirectory
+	var restoredFile string
+	err = filepath.Walk(restoreDir, func(path string, info os.FileInfo, err error) error {
+		if !info.IsDir() && info.Name() == "source.txt" {
+			restoredFile = path
+		}
+		return nil
+	})
+	assert.NoError(t, err)
+	assert.NotEmpty(t, restoredFile, "source.txt not found")
+
+	content, err := os.ReadFile(restoredFile)
+	assert.NoError(t, err)
+	assert.Equal(t, "hello world", string(content))
+}
+
+func TestHooks(t *testing.T) {
+	tempDir := t.TempDir()
+
+	// Create a dummy file to back up
+	sourceFile := "source.txt"
+	err := os.WriteFile(filepath.Join(tempDir, sourceFile), []byte("data"), 0644)
+	assert.NoError(t, err)
+
+	repoPath := filepath.Join(tempDir, "repo")
+	initRepo(t, repoPath)
+
+	configContent := `
+version: 2
+locations:
+  my-data:
+    from: 
+      - ` + sourceFile + `
+    to: local
+    hooks:
+      before:
+        - touch before.txt
+      after:
+        - touch after.txt
+backends:
+  local:
+    type: local
+    path: ` + repoPath + `
+    key: password
+`
+	configPath := filepath.Join(tempDir, "autorestic.yml")
+	err = os.WriteFile(configPath, []byte(configContent), 0644)
+	assert.NoError(t, err)
+
+	// Run backup
+	runAutorestic(t, tempDir, configPath, "backup", "-l", "my-data")
+
+	// Verify
+	assert.FileExists(t, filepath.Join(tempDir, "before.txt"))
+	assert.FileExists(t, filepath.Join(tempDir, "after.txt"))
+}
+
+func TestCopy(t *testing.T) {
+	tempDir := t.TempDir()
+
+	// Create a dummy file to back up
+	sourceFile := "source.txt"
+	err := os.WriteFile(filepath.Join(tempDir, sourceFile), []byte("data"), 0644)
+	assert.NoError(t, err)
+
+	repoPath := filepath.Join(tempDir, "repo")
+	initRepo(t, repoPath)
+
+	remoteRepoPath := filepath.Join(tempDir, "remote_repo")
+	initRepo(t, remoteRepoPath)
+
+	configContent := `
+version: 2
+locations:
+  my-data:
+    from: 
+      - ` + sourceFile + `
+    to: local
+    copy:
+      local:
+        - remote
+backends:
+  local:
+    type: local
+    path: ` + repoPath + `
+    key: password
+  remote:
+    type: local
+    path: ` + remoteRepoPath + `
+    key: password
+`
+	configPath := filepath.Join(tempDir, "autorestic.yml")
+	err = os.WriteFile(configPath, []byte(configContent), 0644)
+	assert.NoError(t, err)
+
+	// Run backup
+	output := runAutorestic(t, tempDir, configPath, "backup", "-l", "my-data")
+
+	// Verify copy in output
+	assert.Contains(t, output, "Copying local → remote")
+}
+
+func TestPermissions(t *testing.T) {
+	tempDir := t.TempDir()
+
+	// 1. Create a source file with specific permissions (0600)
+	sourceFile := "source.txt"
+	sourcePath := filepath.Join(tempDir, sourceFile)
+	err := os.WriteFile(sourcePath, []byte("data"), 0600)
+	assert.NoError(t, err)
+
+	repoPath := filepath.Join(tempDir, "repo")
+	initRepo(t, repoPath)
+
+	configContent := `
+version: 2
+locations:
+  my-data:
+    from: 
+      - ` + sourceFile + `
+    to: local
+backends:
+  local:
+    type: local
+    path: ` + repoPath + `
+    key: password
+`
+	configPath := filepath.Join(tempDir, "autorestic.yml")
+	err = os.WriteFile(configPath, []byte(configContent), 0644)
+	assert.NoError(t, err)
+
+	// 2. Backup
+	runAutorestic(t, tempDir, configPath, "backup", "-l", "my-data")
+
+	// 3. Restore
+	restoreDir := filepath.Join(tempDir, "restore")
+	err = os.MkdirAll(restoreDir, 0755)
+	assert.NoError(t, err)
+	runAutorestic(t, tempDir, configPath, "restore", "-l", "my-data", "--to", restoreDir)
+
+	// 4. Verify permissions
+	// Use walk to find the restored file
+	var restoredFile string
+	err = filepath.Walk(restoreDir, func(path string, info os.FileInfo, err error) error {
+		if !info.IsDir() && info.Name() == "source.txt" {
+			restoredFile = path
+		}
+		return nil
+	})
+	assert.NoError(t, err)
+	assert.NotEmpty(t, restoredFile, "source.txt not found")
+
+	info, err := os.Stat(restoredFile)
+	assert.NoError(t, err)
+
+	// Check permissions (masking only for permission bits)
+	assert.Equal(t, os.FileMode(0600), info.Mode().Perm())
+}

tests/version_test.go

@@ -0,0 +1,14 @@
+package integration_test
+
+import (
+	"github.com/stretchr/testify/assert"
+	"os/exec"
+	"testing"
+)
+
+func TestVersion(t *testing.T) {
+	cmd := exec.Command("go", "run", "../main.go", "--version")
+	out, err := cmd.CombinedOutput()
+	assert.NoError(t, err)
+	assert.Contains(t, string(out), "autorestic")
+}