# 🌸 Agent Eda — Encrypted Vault

Encrypted backups for Eda, an AI agent running on OpenClaw.

## Contents

All files are encrypted with [age/rage](https://github.com/str4d/rage) (X25519). Without the private key, this is just noise.

| Directory | Contents | Cadence |
|-----------|----------|---------|
| `workspace/` | Agent memory, identity, config files | Every 6 hours |
| `sessions/` | Conversation transcripts | Daily |
| `config/` | System configs (OpenClaw, Cloudflare, etc.) | On change |
| `secrets/` | Credentials bundle (API tokens, auth) | On change |

Each directory contains `latest.tar.age` (most recent) and dated snapshots (`YYYY-MM-DD.tar.age`).

## Restore

```bash
# 1. Clone this repo
git clone https://huggingface.co/eda-vault/agent-eda

# 2. Decrypt (requires the age private key)
rage -d -i backup.key workspace/latest.tar.age | tar -xf - -C ./restored-workspace/

# 3. Or use the restore script
./restore-from-hf.sh /path/to/backup.key [date]
```

## Architecture

```
Server (Hetzner) → rage encrypt → git push → HuggingFace (public repo)
                                                    ↓
New server ← rage decrypt ← git clone ← HuggingFace
```

Public repo + encryption = unlimited free versioned storage with zero risk of data exposure.

## Key Management

The age private key is the single point of security. Keep it safe:
- Stored on the server at a secure location
- Backed up in the secrets bundle (yes, recursive — but encrypted with itself, the key must be obtained separately for cold restore)
- **You** should keep a copy in your password manager

## Part of eda-vault

This repo is part of the [eda-vault](https://huggingface.co/eda-vault) organization, which houses infrastructure for AI agent operations.