Configuration¶

This page shows where the backup settings live and how to make the common changes: what to back up, moving the repository to Amazon S3, retention and the schedule. Edit the files as root.

Where things live¶

Path	What it is
`/etc/restic/restic.env`	Backup settings, one `KEY=value` per line.
`/etc/restic/password`	Repository password. Readable by the `restic` user only.
`/var/lib/restic/include`	Default folder to back up.
`/var/lib/restic/repo`	Default local repository.
`/var/lib/restic/cache`	restic's cache.
`/opt/sushi/bin/restic-backup.sh`	Backs up the configured paths.
`/opt/sushi/bin/restic-check.sh`	Checks the repository.
`/opt/sushi/bin/restic-restore.sh`	Restores the latest snapshot into an empty directory.

The shipped settings:

RESTIC_REPOSITORY=/var/lib/restic/repo
RESTIC_PASSWORD_FILE=/etc/restic/password
RESTIC_CACHE_DIR=/var/lib/restic/cache
RESTIC_BACKUP_PATHS=/var/lib/restic/include

All four keys are required. Values are used exactly as written: the file is not run as a shell script, so do not quote values or use $VARIABLES. Lines that start with # are comments. Never put passwords or access keys in this file.

To run any restic command with these settings, load them as the restic user:

sudo -u restic bash -c 'source /opt/sushi/bin/restic-load-env.sh && restic snapshots'

Choose what to back up¶

You have two ways:

Copy files into the backup folder as root, then hand them to the restic user:

sudo cp -a <path> /var/lib/restic/include/
sudo chown -R restic:restic /var/lib/restic/include

Back up other folders by listing them in RESTIC_BACKUP_PATHS, separated by spaces, and giving the restic user read access to them:
```
RESTIC_BACKUP_PATHS=/var/lib/restic/include /srv/app/data
```

restic can only protect files that the restic user can read. The scheduled backup runs in a sandbox that hides /home, /root and /run/user, so it cannot back up files there. Paths with spaces are not supported. Each backup stays on one file system (--one-file-system).

Databases need a dump first

Copying the files of a running database does not give you a consistent backup. Dump the database to a file in a backed-up folder first, and back up the dump.

Use an Amazon S3 repository¶

The default repository lives on the instance's root volume and disappears with the instance. To keep backups in your own S3 bucket:

Create the bucket in an account you control.
Create an IAM role for the instance that allows s3:ListBucket on the bucket, and s3:GetObject, s3:PutObject and s3:DeleteObject on the prefix you will use. Attach it as the instance profile, alongside AmazonSSMManagedInstanceCore. Do not put access keys on the instance.

In /etc/restic/restic.env, set the repository:

RESTIC_REPOSITORY=s3:s3.amazonaws.com/<bucket>/<prefix>

Initialize the new repository. First boot initialized only the local one:

sudo -u restic bash -c 'source /opt/sushi/bin/restic-load-env.sh && restic init'

Run a backup, a check and a test restore, as in Getting started, before you depend on it.

The repository password in /etc/restic/password also encrypts the S3 repository. Keep a copy: a new instance can read the bucket only with it.

Retention¶

Retention is not configured, so every snapshot is kept and the repository only grows. When you are ready, remove old snapshots with restic forget and reclaim space with --prune, for example to keep seven daily and four weekly snapshots:

sudo -u restic bash -c 'source /opt/sushi/bin/restic-load-env.sh && restic forget --keep-daily 7 --keep-weekly 4 --prune'

Read the restic documentation on removing snapshots before you run it, and try it with --dry-run first.

Change the schedule¶

restic-backup.timer runs once a day, with a random delay of up to 15 minutes, and catches up at boot if a run was missed while the instance was stopped. To change when it runs, override the timer:

sudo systemctl edit restic-backup.timer

For example, to run at 02:30 every day:

[Timer]
OnCalendar=
OnCalendar=*-*-* 02:30:00

Then check the next run:

systemctl list-timers restic-backup.timer