AI resource

The AI resource is an NGBackup extension (no stock Bacula equivalent). It names an LLM API connection that the ai console verb configures and queries, together with a Context Directory whose text files are fed to the model as context. Supported providers: Anthropic (Claude, the default) and OpenAI.

This is the single AI configuration for the whole deployment: the Web and Desktop consoles consume the same resource over the console connection (.dirjson resource=AI, ApiKey redacted over the wire), so there is no separate per-console AI configuration. The legacy AiApi {} block is no longer a typed resource; replace it with an AI {} block.

Define one or more AI {} resources in the Director configuration. A commented example ships in the generated backup-dir.conf:

AI {
  Name = primary
  Provider = anthropic
  Model = claude-opus-4-8
  ContextDirectory = /opt/backup/context
  ApiKey = "@secret:ai-primary-key"
}

The API key is sealed, never plaintext

Set the key with ai configure ai=primary apikey=sk-ant-... from the console. The verb seals it into the Director’s secrets.enc store and rewrites the ApiKey directive to an @secret:ai-<name>-key reference — the key never sits in plaintext in backup-dir.conf. This is the same sealed-secret mechanism the daemons use for shared passwords.

Name

Name = <name>

Required. The resource name, referenced by the ai console verb (ai query ai=<name> …).

Description

Description = <text>

Optional operator-visible description.

Provider

Provider = <provider>

The LLM provider: anthropic (the default when unset) or openai. The provider selects the API dialect (Anthropic Messages vs OpenAI chat-completions), the default endpoint, the auth header, and the default model.

Model

Model = <model-id>

The model id. Defaults per provider when unset: claude-opus-4-8 (anthropic) or gpt-4o-mini (openai). Any current model id of the configured provider is accepted.

Endpoint

Endpoint = <url>

Optional API base-URL override (no trailing slash). When unset, the provider’s public endpoint is used (https://api.anthropic.com or https://api.openai.com). Useful for a proxy or a compatible gateway.

ApiKey

ApiKey = <value-or-secret-ref>

The API key. In practice this is an @secret:ai-<name>-key reference written by ai configure; you can also set a literal value or @secret: reference by hand. Resolved to plaintext at config load and held only in memory.

ContextDirectory

ContextDirectory = <path>

Directory whose UTF-8 text files are concatenated (newest first, capped at ~100 KB total) into the model’s system prompt on every ai query. Defaults to /opt/backup/context when unset, and the effective directory is auto-created when the Director starts or reloads. Drop reference material (runbooks, policy notes, config excerpts) here for the model to draw on.

ConfirmDestructive

ConfirmDestructive = <yes|no>

Operator approval gate consoles apply to destructive AI-proposed commands. Default: yes (fail-safe — the console asks before running anything destructive).