Backups are a security control: they're your recovery from ransomware, a bad command, or hardware death. restic gives encrypted, deduplicated, versioned snapshots.
Initialize a repo
export RESTIC_REPOSITORY="/mnt/backups/restic"
export RESTIC_PASSWORD_FILE="/root/.restic-pass" # keep this safe! (see Secrets Management)
restic initBack up
restic backup /var/www /etc /home/youruser --exclude-caches
restic snapshotsThe 3-2-1 rule
3 copies, on 2 different media, with 1 off-site. A backup on the same box that gets ransomwared is not a backup.
| Practice | Why |
|---|---|
| Encrypt at rest | restic encrypts by default |
| Off-site copy | restic copy to S3/B2/another host |
| Test restores | An untested backup is a guess |
| Automate | systemd timer / cron nightly |
Restore & verify
restic restore latest --target /tmp/restore --include /var/www/wiki.thelabsource.com
restic check # verify repo integrityAutomate with a nightly systemd timer. Store the repo password per Secrets Management. Back up the DB too:
mysqldump | restic backup --stdin.