restic-backup-suite: Installation

Installing restic-backup-suite: requirements, install.sh, password file, SFTP access, manual use without the installer, updating and uninstalling.

Deutsche Version

Back to overview

Installation

Requirements

Requirement	Note
Bash 4.4 or newer	All scripts use Bash arrays and `set -o nounset`
restic	Must be in `PATH`. The backup calls `restic backup --compression max`, so the restic version must support compression
root	Every script aborts with `This script must be run as root.` otherwise
sftp	Only for a repository with the `sftp:` prefix (connection test before the backup)
docker	Only for Docker database dumps and `DOCKER_SERVICES_TO_STOP`
`mariadb-dump` or `mysqldump`, plus `mariadb` or `mysql`	Only for `MYSQL_BACKUP_ENABLED=true`. Restoring SQL dumps needs the `mysql` client
`/etc/cron.d`	Only for the installer's optional cron job

With the installer

git clone https://github.com/markus-michalski/restic-backup-suite.git
cd restic-backup-suite
sudo ./install.sh

The installer creates:

What	Where	Mode
Configuration directory	`/etc/restic/`	700
Configuration file (copy of `config.example.sh`, never overwritten)	`/etc/restic/config.sh`	600
Current template	`/etc/restic/config.example.sh`	640
Log directory	`/var/log/restic/`	750
Symlinks to the scripts	`/usr/local/bin/restic-backup`, `/usr/local/bin/restic-restore`, `/usr/local/bin/restic-inspect`
Shell aliases	`/etc/profile.d/restic-aliases.sh`	644

The symlinks point at the scripts in the cloned directory. Do not delete or move the clone after installing.

If restic is missing, the installer prints hints and asks whether to continue anyway.

A config.sh in the clone directory takes precedence over /etc/restic/config.sh. The scripts look for <script directory>/config.sh first and /etc/restic/config.sh second. Use --config to name a file explicitly.

Create the password file

The installer does not create a password file. Create it and point RESTIC_PASSWORD_FILE in config.sh to it (template value: /etc/restic/password.txt):

umask 077
printf '%s' 'your-strong-passphrase' > /etc/restic/password.txt
chmod 400 /etc/restic/password.txt

Without this password the backups cannot be read. Keep a copy outside the server as well. See Security.

Edit the configuration

sudo nano /etc/restic/config.sh

All keys are listed on the Configuration page.

Prepare SFTP access

Only needed when RESTIC_REPOSITORY starts with sftp:.

Create a dedicated key, for example ssh-keygen -t ed25519 -f /root/.ssh/id_ed25519_backup -N "".
Install the public key on the target server.
Set SSH_KEY_FILE, SSH_HOST, SSH_HOSTNAME, SSH_PORT and SSH_USER in config.sh.
Add the target server's host key to root's known_hosts, for example with ssh-keyscan -p <port> <hostname> >> /root/.ssh/known_hosts.

backup.sh writes the SSH configuration itself on each run (see Technical details) and tests the connection with sftp -o BatchMode=yes. The host key must therefore be known beforehand, otherwise the test fails.

SSH_KNOWN_HOSTS_FILE appears in the template but no script reads it. Add the host key to the default known_hosts.

First run

sudo restic-backup --dry-run
sudo restic-backup

Read the note on --dry-run on the Usage page first. If the repository does not exist yet, backup.sh initialises it on the first run.

Cron job

sudo ./install.sh --cron

Details are on the Scheduling page.

Without the installer

git clone https://github.com/markus-michalski/restic-backup-suite.git
cd restic-backup-suite
cp config.example.sh config.sh
chmod 600 config.sh
sudo ./backup.sh --dry-run

The scripts then read config.sh from the clone directory. There are no aliases and no cron job in this case.

Updating

Update the clone (git pull). The symlinks point at these files, so the new scripts are active immediately. Running sudo ./install.sh again does not overwrite /etc/restic/config.sh but refreshes config.example.sh, the symlinks and the aliases. Compare new keys in config.example.sh with your config.sh.

Uninstalling

sudo ./install.sh --uninstall

This removes the three symlinks, /etc/profile.d/restic-aliases.sh and /etc/cron.d/restic-backup. The installer then asks whether to delete /etc/restic. The log directory, the repository and a password file outside /etc/restic stay in place.

If you answer y, /etc/restic is deleted with everything in it. If your password file lives there (as in the template), it is gone afterwards. Back it up first.