Start from nothing with restic

You run these on your server. Ballast doesn't run them and can't: it only reads.

We ran these exact commands on Debian with restic 0.18, reading back as a separate account. Other tools are fine too: see the Borg and Kopia quick starts. Change /srv/data to what you want to keep.

1. Install, and make a group that can read

sudo apt install restic
sudo groupadd backupread
sudo usermod -aG backupread ballast

2. Make a password

Save a copy somewhere that isn't this server. Without it, nobody can restore these backups.

sudo install -d -m 750 -g backupread /etc/restic
head -c 32 /dev/urandom | base64 | sudo tee /etc/restic/password > /dev/null
sudo chgrp backupread /etc/restic/password
sudo chmod 640 /etc/restic/password

3. Create the repository

sudo install -d -m 2750 -g backupread /srv/backups/restic
sudo restic -r /srv/backups/restic --password-file /etc/restic/password init
sudo chgrp -R backupread /srv/backups/restic
sudo chmod -R g+rX,g-w /srv/backups/restic
sudo find /srv/backups/restic -type d -exec chmod g+s {} +

4. Make the first backup

sudo restic -r /srv/backups/restic --password-file /etc/restic/password backup /srv/data

5. Schedule it, and keep a sensible history

Put this on one line in /etc/cron.d/restic-backup. Ballast finds schedules there.

0 3 * * * root restic -r /srv/backups/restic --password-file /etc/restic/password backup /srv/data && restic -r /srv/backups/restic --password-file /etc/restic/password forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

6. Keep a copy somewhere else

A repository on the same disk won't survive that disk. Make a second one elsewhere and copy to it after each backup. Change the path to your own: an external drive, or sftp:user@host:/path.

sudo restic -r /mnt/usb/restic --password-file /etc/restic/password init --from-repo /srv/backups/restic --from-password-file /etc/restic/password --copy-chunker-params
sudo restic -r /mnt/usb/restic --password-file /etc/restic/password copy --from-repo /srv/backups/restic --from-password-file /etc/restic/password

7. Add it to Ballast

Add your server, signed in as ballast, and tap Find. It should offer restic → /srv/backups/restic.

8. Test a restore

Don't skip this one. See Test a restore.