restic
Encrypted, deduplicated backups from the command line.
restic is a fast, open-source backup program for the command line. It encrypts every backup with your password and stores only changed data, so repeated backups are small. It works with a Zata bucket as an S3 repository.
Before you start
- A bucket. See Create a bucket.
- An access key from the same region as the bucket. See Access keys.
- restic installed (see below).
Install restic
Check first whether restic is installed with restic version. To install it on Linux (x86-64):
curl -L https://github.com/restic/restic/releases/download/v0.19.1/restic_0.19.1_linux_amd64.bz2 | bunzip2 > restic
chmod +x restic
sudo mv restic /usr/local/bin/
restic version
Ubuntu's apt install restic gives an old version (0.12). For Windows, macOS or ARM Linux, see the restic installation guide.
Connection settings
| Setting | Value |
|---|---|
RESTIC_REPOSITORY | s3:https://idr01.zata.ai/my-bucket/restic for Indore, s3:https://bom01.zata.ai/my-bucket/restic for Mumbai |
AWS_ACCESS_KEY_ID / AWS_SECRET_ACCESS_KEY | From Access Keys in the Zata console. The key must be from the same region as the bucket. |
AWS_DEFAULT_REGION | us-east-1 |
| Path-style | Add -o s3.bucket-lookup=path to every restic command |
The /restic at the end of the repository is a folder inside your bucket, not a new bucket. restic does not use the AWS SDK, so it needs no checksum or signature settings for Zata.
Set up restic
Replace my-bucket with your bucket name, and idr01 with bom01 if the bucket is in Mumbai.
export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
export AWS_DEFAULT_REGION=us-east-1
export RESTIC_REPOSITORY="s3:https://idr01.zata.ai/my-bucket/restic"
These export lines last only for the current terminal.
restic encrypts every backup with this password. This asks for it without showing it, so it never lands in your shell history:
umask 077
read -rsp "Choose a restic repository password: " RESTIC_PASSWORD; echo
printf '%s' "$RESTIC_PASSWORD" > ~/.restic-password
unset RESTIC_PASSWORD
export RESTIC_PASSWORD_FILE=~/.restic-password
Keep a copy of the password somewhere safe. If it is lost, nobody can restore the backups, and Zata cannot recover it.
restic -o s3.bucket-lookup=path init
restic -o s3.bucket-lookup=path backup ~/documents
Test it
List the snapshots, restore the latest one to a separate folder, and check the repository:
restic -o s3.bucket-lookup=path snapshots
restic -o s3.bucket-lookup=path restore latest --target ~/restore
restic -o s3.bucket-lookup=path check
Open a few restored files to confirm they are complete.
Remove old snapshots
restic keeps every snapshot until you remove it. This keeps the last 7 daily and 4 weekly snapshots and deletes the data no longer needed:
restic -o s3.bucket-lookup=path forget --keep-daily 7 --keep-weekly 4 --prune
Run it on a schedule
For scheduled backups (cron), put the settings in a script that only you can read:
#!/bin/bash
export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
export AWS_DEFAULT_REGION=us-east-1
export RESTIC_REPOSITORY="s3:https://idr01.zata.ai/my-bucket/restic"
export RESTIC_PASSWORD_FILE="$HOME/.restic-password"
restic -o s3.bucket-lookup=path backup "$HOME/documents"
Make it private and executable:
chmod 700 ~/restic-backup.sh
Then run crontab -e and add this line to run it every night at 02:00:
0 2 * * * $HOME/restic-backup.sh >> $HOME/restic-backup.log 2>&1
Troubleshooting
| Problem | Fix |
|---|---|
unable to open config file | The repository does not exist yet. Run restic -o s3.bucket-lookup=path init once. |
| Access denied or invalid key | Copy the keys again from Access Keys. The key must be from the same region as the endpoint in RESTIC_REPOSITORY. |
wrong password or no key found | Use the exact password you chose at init. It cannot be reset. |
| Repository URL errors | The format is s3:https://idr01.zata.ai/my-bucket/restic. Do not write s3:s3://. |
For other errors, see Signature errors and Endpoint and region.