Skip to content

Operations

This page covers running the backup worker day to day: how it is secured, checking backups, logs, protecting the password, updates and support.

Security model

  • No open ports. restic does not listen on the network.
  • Encrypted repository. Everything in the repository is encrypted with the password in /etc/restic/password.
  • Per-instance password. The password is created on first boot and never printed. The image contains no password and no repository.
  • Least privilege. Backups run as the restic user, which can read only what you give it. The ubuntu user cannot read the password file.
  • Service sandbox. The backup service can write only to /var/lib/restic, and cannot see /home, /root or /run/user.
  • No AWS access by default. The instance needs an IAM role only when you use an S3 repository, and that role should cover only your bucket.

Check your backups

Look at the timer and the last run:

systemctl list-timers restic-backup.timer
systemctl status restic-backup.service --no-pager

Verify the repository's structure:

sudo -u restic /opt/sushi/bin/restic-check.sh

A backup you have never restored is not a backup. Restore into an empty directory from time to time and compare the files:

sudo -u restic /opt/sushi/bin/restic-restore.sh /tmp/restore-check-<date>

The restore script refuses /, /var, /etc, any backed-up folder and the local repository, requires an empty target directory, and never overwrites existing files. Use a target that only the restoring user can change.

Logs

Each run logs to the systemd journal:

sudo journalctl -u restic-backup.service -n 100 --no-pager
sudo journalctl -u sushi-restic-firstboot --no-pager

Protect the repository password

Without /etc/restic/password, nobody can read the repository, including you. Copy it to a secret store you already trust as soon as you start relying on the backups. Never paste it into tickets, recordings or chat.

Replace the instance

A new instance creates its own password and an empty local repository. To carry on with existing backups:

  1. Launch the new instance and let first boot finish.
  2. Copy /etc/restic/ from the old instance, keeping /etc/restic/password owned by restic:restic with mode 0600.
  3. For a local repository, also copy /var/lib/restic/repo, or restore it from a volume snapshot. An S3 repository is already in place; attach the same kind of IAM role to the new instance.
  4. Run a check and a test restore before you rely on it.

Volume snapshots are a simple way to protect a local repository. An S3 repository survives the instance on its own.

Updates

  • Ubuntu packages receive unattended security updates.
  • restic itself is a pinned binary and is not updated by apt. A new restic release comes as a new version of the image. Running instances are not migrated: launch the new version and move across as above.

Support

Software Sushi supports the packaging, first-boot setup and this documentation. Email info@softwaresushi.com with the output of restic version, what you ran and the error. Never include the repository password. Support coverage beyond installation questions requires a separate agreement. The restic project does not provide support for this image.