Encrypted Linux Backups with Restic and S3
- AuthorTimothy M.
- Date
- Time16 minutes
Step 1: Install Restic
bash
sudo apt update
sudo apt install -y resticStep 2: Configure Environment Variables
Use an S3-compatible endpoint (AWS S3, Backblaze, Wasabi, MinIO, etc.).
bash
cat > ~/.restic-env <<'EOF'
export AWS_ACCESS_KEY_ID="YOUR_ACCESS_KEY"
export AWS_SECRET_ACCESS_KEY="YOUR_SECRET_KEY"
export RESTIC_REPOSITORY="s3:https://s3.example.net/my-server-backups"
export RESTIC_PASSWORD="REPLACE_WITH_LONG_RANDOM_PASSWORD"
EOF
chmod 600 ~/.restic-env
source ~/.restic-envStep 3: Initialize Repository
bash
restic initStep 4: Create Exclude File
bash
cat > ~/.restic-excludes <<'EOF'
/proc
/sys
/dev
/run
/tmp
/var/tmp
/mnt
/media
swapfile
EOFStep 5: Run First Full Backup
bash
restic backup / --exclude-file ~/.restic-excludes --one-file-system --verboseStep 6: Check Snapshots and Integrity
bash
restic snapshots
restic checkStep 7: Apply Retention Policy
bash
restic forget --prune --keep-daily 7 --keep-weekly 4 --keep-monthly 6Step 8: Create Automation Script
bash
sudo tee /usr/local/bin/restic-backup.sh >/dev/null <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
source /root/.restic-env
restic backup / --exclude-file /root/.restic-excludes --one-file-system
restic forget --prune --keep-daily 7 --keep-weekly 4 --keep-monthly 6
restic check --read-data-subset=1/20
EOF
sudo chmod +x /usr/local/bin/restic-backup.shStep 9: Schedule Daily Run with systemd Timer
bash
sudo tee /etc/systemd/system/restic-backup.service >/dev/null <<'EOF'
[Unit]
Description=Restic Backup
[Service]
Type=oneshot
ExecStart=/usr/local/bin/restic-backup.sh
EOF
sudo tee /etc/systemd/system/restic-backup.timer >/dev/null <<'EOF'
[Unit]
Description=Run Restic backup daily
[Timer]
OnCalendar=*-*-* 03:30:00
Persistent=true
[Install]
WantedBy=timers.target
EOF
sudo systemctl daemon-reload
sudo systemctl enable --now restic-backup.timer
systemctl list-timers | grep resticStep 10: Restore Drill (Required)
bash
mkdir -p /tmp/restic-restore-test
restic restore latest --target /tmp/restic-restore-test --include /etc
ls -la /tmp/restic-restore-test/etc"Backups that were never restored are assumptions. Always include restore drills in your runbook."
