Skip to main content

Setting up backups with restic

restic is a free backup tool that encrypts backups on the client side, deduplicates them and writes them incrementally to an S3 repository.

Prerequisites​

  • S3 access credentials and a Bucket (e.g. restic-backups)
  • restic installed (apt install restic, dnf install restic, brew install restic or similar)

Initialise the repository​

export AWS_ACCESS_KEY_ID="IHR_ACCESS_KEY"
export AWS_SECRET_ACCESS_KEY="IHR_SECRET_KEY"
export RESTIC_REPOSITORY="s3:https://s3.internet1.de/restic-backups"
export RESTIC_PASSWORD="ein-sicheres-repository-passwort"

restic init
Keep your repository password safe

Without this password, the backups are irretrievably lost – it cannot be reset.

Create a backup​

restic backup /etc /home /var/www

# Mit Ausschlüssen
restic backup /home --exclude="*.tmp" --exclude="/home/*/cache"

View snapshots:

restic snapshots

Restore​

# Kompletten Snapshot wiederherstellen
restic restore latest --target /tmp/restore

# Einzelne Pfade
restic restore latest --target /tmp/restore --include /etc/nginx

# Im Repository suchen
restic find "nginx.conf"

Storage & Tidying Up​

# Behalte: 7 tägliche, 4 wöchentliche, 6 monatliche Snapshots
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

--prune also physically removes data that is no longer referenced from the bucket.

Automation (systemd timer)​

/etc/restic/env (right-hand 600):

AWS_ACCESS_KEY_ID=IHR_ACCESS_KEY
AWS_SECRET_ACCESS_KEY=IHR_SECRET_KEY
RESTIC_REPOSITORY=s3:https://s3.internet1.de/restic-backups
RESTIC_PASSWORD=ein-sicheres-repository-passwort

/etc/systemd/system/restic-backup.service:

[Unit]
Description=restic Backup

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/env
ExecStart=/usr/bin/restic backup /etc /home /var/www
ExecStartPost=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

/etc/systemd/system/restic-backup.timer:

[Unit]
Description=Tägliches restic Backup

[Timer]
OnCalendar=*-*-* 02:30:00
Persistent=true

[Timer]
WantedBy=timers.target
systemctl enable --now restic-backup.timer

Check integrity​

restic check                      # Repository-Struktur prüfen
restic check --read-data-subset=5%   # Stichprobe der Daten lesen
Last updated on