Nightly encrypted backup with the CLI and cron

You need: a Mac or Linux machine that can see a copy of the vault folder (a sync target in iCloud Drive or another synced folder, or a copy the CLI keeps with sempere sync), a backup disk or share, and the sempere CLI (Install).

A backup run copies only encrypted files. It needs no key, so the scheduled job never holds anything that could read your notes.

1. Find the paths

which sempere                                  # e.g. /usr/local/bin/sempere
VAULT="$HOME/Library/Mobile Documents/com~apple~CloudDocs/My Notes.sempere"   # iCloud Drive on a Mac
BACKUP=/Volumes/Backup/Notes.sempere-backup                   # an external disk, or a NAS mount

On a Mac with an iCloud Drive vault, make sure the vault is fully downloaded: in the Finder, select the folder and choose Keep Downloaded. A backup cannot copy files that are only in the cloud. (A sync target lags a little behind your devices; the next run copies what arrived since.)

2. Run it once by hand

sempere backup "$VAULT" --to "$BACKUP"
sempere backup verify "$BACKUP"

The first run copies everything; later runs only what is new. verify checks the copy’s structure and every file’s hash, again without a key. The backup is a vault folder plus a backup.json and a versions/ folder. It is a snapshot for recovery: nothing syncs from it.

3. Schedule it

Edit your crontab with crontab -e and add (with your own paths, always absolute):

# 02:30 every night: copy what is new. Quiet unless something fails.
30 2 * * *  /usr/local/bin/sempere backup "/Users/me/Library/Mobile Documents/com~apple~CloudDocs/My Notes.sempere" --to /Volumes/Backup/Notes.sempere-backup -q
# Sundays 03:30: check the backup.
30 3 * * 0  /usr/local/bin/sempere backup verify /Volumes/Backup/Notes.sempere-backup -q
# 09:00 daily: complain if there was no complete backup for 7 days.
0 9 * * *   /usr/local/bin/sempere backup status /Volumes/Backup/Notes.sempere-backup --max-age 7 >/dev/null || echo "Sempere backup is overdue"

With -q, a healthy run prints nothing, so cron only mails you about problems. backup status --max-age 7 exits with 3 when the newest complete backup is older than seven days.

On a Mac, cron needs Full Disk Access to reach iCloud Drive and external disks: System Settings ▸ Privacy & Security ▸ Full Disk Access, add /usr/sbin/cron (and sempere). A launchd agent or, on Linux, a systemd timer works the same way; the CLI reference has examples of both.

4. Add an off-site copy

The backup folder holds only encrypted files, so copy it anywhere: rsync -a /Volumes/Backup/Notes.sempere-backup/ friend-nas:/backups/notes/, a cloud bucket, a second disk you keep elsewhere. Or write a single file now and then:

sempere backup "$VAULT" --archive ~/notes-$(date +%F).tar

5. Test a restore, once

A backup you have never restored is a hope. With the recovery key (typed from the kit into a file only you can read):

sempere backup verify /Volumes/Backup/Notes.sempere-backup --recovery-key ~/key.txt   # decrypts every revision
sempere restore /Volumes/Backup/Notes.sempere-backup --to ~/Restore-test.sempere --recovery-key ~/key.txt
sempere notes list --vault ~/Restore-test.sempere --recovery-key ~/key.txt

Then delete ~/Restore-test.sempere and the key file.

About keys in scheduled jobs

Keep the key out of cron. Two options need it, and you can run them by hand instead: a full decrypting verify, and --prune, which deletes backup history that the vault has already thinned away. If you must automate them, let the machine join the vault as a device of its own (its key stays in ~/.local/state/sempere, mode 600), and accept that the machine then holds the means to read your notes. Never leave the recovery key on it.