Skip to content

Getting started

This page takes you from the AWS Marketplace listing to a tested backup: subscribe, launch, connect, back up a file, then restore it.

You need: an AWS account with permission to subscribe to AWS Marketplace products, launch EC2 instances and use AWS Systems Manager.

1. Subscribe

Open the restic listing in AWS Marketplace, choose View purchase options, review the terms and subscribe. When the subscription is confirmed, choose Launch your software.

2. Launch the instance

On the EC2 launch page:

  1. Keep the instance type at t3.medium.
  2. Under Configure storage, use an encrypted gp3 root volume of at least 16 GiB, larger if the repository will stay on the instance.
  3. Under Network settings, allow no inbound traffic. If you also want SSH, allow port 22 from your administrative address range only.
  4. Under Advanced details, choose an IAM instance profile that includes the AWS managed policy AmazonSSMManagedInstanceCore, so you can connect with Session Manager.
  5. Choose Launch instance.

3. Connect

In the EC2 console, select the instance, choose Connect, then Session Manager, then Connect. Switch to the ubuntu user:

sudo -iu ubuntu

4. Wait for first boot

On first boot the instance creates the repository password and initializes the local repository:

cloud-init status --wait
systemctl is-active sushi-restic-firstboot
systemctl list-timers restic-backup.timer

5. Run the walkthrough

bash /opt/sushi/docs/demo.sh

6. Back up a file

Put something in the backup folder and give it to the restic user, which runs the backups:

echo "hello from restic" | sudo tee /var/lib/restic/include/hello.txt
sudo chown restic:restic /var/lib/restic/include/hello.txt

Run a backup now instead of waiting for the timer:

sudo systemctl start restic-backup.service
systemctl status restic-backup.service --no-pager

List the snapshots:

sudo -u restic bash -c 'source /opt/sushi/bin/restic-load-env.sh && restic snapshots'

7. Restore it

The restore script restores the latest snapshot into an empty directory that you name. It never restores over your live files:

sudo -u restic /opt/sushi/bin/restic-restore.sh /tmp/restore-test
sudo cat /tmp/restore-test/var/lib/restic/include/hello.txt

Files come back under their original path inside the directory you named. The directory belongs to the restic user, so read it with sudo.

Next, read Configuration to choose what to back up and to move the repository to S3.

Keep a copy of the repository password

The repository is encrypted with the password in /etc/restic/password. If you lose it, nobody can read your backups. Store a copy somewhere you already trust, and never paste it into tickets or chat.