Tag: backup to wasabi using restic

Reliable Cloud Backups with Restic, Wasabi, and Debian 12

When it comes to safeguarding your data, simplicity and reliability go a long way. In this post, we’ll walk through how you can set up automatic, secure backups from a Debian 12 server to Wasabi cloud storage using Restic, a powerful yet minimalistic tool.

Getting Started: What You Need

Before diving in, make sure you have:

  • A server running Debian 12
  • A Wasabi S3 bucket and access credentials
  • Restic installed (sudo apt install restic)

This guide assumes you have root or sudo access to your server.

Why This Combo Works

Restic is fast and secure. Every backup is encrypted, deduplicated, and verifiable. You don’t need to worry about managing complex configurations, just set your targets and go.

Wasabi makes a compelling cloud destination because of its predictable pricing and no-egress fees. It supports the S3 API, so it plugs right into Restic with no extra effort.

Debian 12 offers a stable foundation. It’s lean, long-term supported, and friendly to automation. A perfect base for a backup system that just works.

Step-by-Step Setup

1. Set Your Credentials

Create a secure file at /var/app/secret/.restic:

export AWS_ACCESS_KEY_ID=dummy-access-key
export AWS_SECRET_ACCESS_KEY=dummy-secret-key
export RESTIC_REPOSITORY=s3:https://s3.ap-northeast-2.wasabisys.com/my-backup-bucket
export SERVER_NAME=vm-debian12-backup
export LOCAL_REPOSITORY=/var/app
Code language: JavaScript (javascript)

Make sure it’s protected:

chmod 600 /var/app/secret/.restic
Code language: JavaScript (javascript)

You can also use aws configure --profile restic if you prefer storing credentials globally.

2. Create a Restic Password File

echo "SuperStrongBackupPassword" | sudo tee /var/app/secret/.restic-password > /dev/null
chmod 600 /var/app/secret/.restic-password
Code language: JavaScript (javascript)

3. Initialize the Backup Repository

source /var/app/secret/.restic
restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" init --password-file /var/app/secret/.restic-password
Code language: JavaScript (javascript)

You should see confirmation that the repo was created.

4. Prepare Inclusion and Exclusion Lists

Create a list of folders to back up:

echo -e "/var/www\n/etc\n/home" > /var/app/script/restic-backup-list.txt
Code language: PHP (php)

And what to exclude:

echo -e "*.log\n*.tmp\n/cache" > /var/app/script/restic-exclude-list.txt
Code language: PHP (php)

5. Write the Backup Script

#!/bin/bash
source /var/app/secret/.restic

if ! restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" cat config \
  --password-file /var/app/secret/.restic-password > /dev/null 2>&1; then
  restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" init \
    --password-file /var/app/secret/.restic-password
fi

restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" unlock \
  --password-file /var/app/secret/.restic-password

restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" backup \
  --files-from /var/app/script/restic-backup-list.txt \
  --exclude-file /var/app/script/restic-exclude-list.txt \
  --tag "$SERVER_NAME" \
  --password-file /var/app/secret/.restic-password

restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" forget \
  --keep-last 7 --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune \
  --password-file /var/app/secret/.restic-password
Code language: JavaScript (javascript)

Make it executable:

chmod +x /var/app/script/restic.sh
Code language: JavaScript (javascript)

6. Automate with Cron

Add this to your root crontab:

0 2 * * * bash /var/app/script/restic.sh >> /var/log/restic-backup.log 2>&1
Code language: JavaScript (javascript)

Final Thoughts

By combining Restic, Wasabi, and Debian 12, you get a backup solution that’s simple, secure, and cost-effective. It’s easy to set up, scales well with your data, and gives you peace of mind that your backups are both safe and retrievable, without surprise costs.

If you want to build on this, you can add Telegram alerts, log monitoring, or even snapshot browsers. But this setup gives you a rock-solid foundation to start with.

Setting Up Restic Backups to Wasabi S3-Compatible Storage on Debian 12 Bullseye

Backups are essential for ensuring data security. In this guide, I will walk you through setting up Restic, a fast and secure backup tool, to work with Wasabi S3-compatible storage on Debian 12 Bullseye.

This tutorial uses the Wasabi region Osaka (ap-northeast-2) and a bucket named bucket-osaka-sandbox.

We will organize backups using subdirectories and tags for each virtual machine.

Step 1.1 : Install Restic

First, install Restic using the package manager.

sudo apt update
sudo apt install restic -y

Verify the installation:

restic version

Step 1.2 : Install AWS CLI

Next, install AWS CLI using the package manager.

sudo apt update
sudo apt install aws-cli -y

Setup the access key and secret key using value from Wasabi:

aws configure

Step 2: Set Up Environment Files

Create a directory to store Restic configuration files:

sudo mkdir -p /etc/restic.d
sudo chmod 700 /etc/restic.d
2.1 Create the .restic-env File

This file stores environment variables for Restic. Use the following template:

sudo vi /etc/restic.d/.restic-env

Add the following content:

SERVER_NAME=vm-osaka-1
LOCAL_REPOSITORY=/var/app
AWS_ACCESS_KEY_ID=your_wasabi_access_key
AWS_SECRET_ACCESS_KEY=your_wasabi_secret_key
RESTIC_REPOSITORY=s3:https://s3.ap-northeast-2.wasabisys.com/bucket-osaka-sandbox
Code language: JavaScript (javascript)

Replace your_wasabi_access_key and your_wasabi_secret_key with your Wasabi credentials.

Secure the file:

sudo chmod 600 /etc/restic.d/.restic-env
2.2 Create the .restic-password File

This file stores the encryption password for your backups.

sudo vi /etc/restic.d/.restic-password

Add a strong password:

your_secure_password

Secure the file:

sudo chmod 600 /etc/restic.d/.restic-password

Step 3: Create the Restic Script

Next, create a bash script to handle Restic operations.

sudo vi /etc/restic.d/.restic.sh

Add the following content:

#!/bin/bash

source /etc/restic.d/.restic-env

# Option 0 - Change password
#restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" key passwd

# Option 1 - Init repository
#restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" init --password-file "/var/app/secret/.restic-password"

# Option 2 - Backup
restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" backup "$LOCAL_REPOSITORY" --tag "$SERVER_NAME" --password-file "/etc/restic.d/.restic-password" --verbose

# Option 3 - List snapshots
restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" snapshots --password-file "/etc/restic.d/.restic-password" --verbose

# Option 4 - Housekeeping
restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" forget --keep-last 7 --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune --password-file "/etc/restic.d/.restic-password" --verbose
Code language: PHP (php)

Make the script executable:

sudo chmod +x /etc/restic.d/.restic.sh

Step 4: Initialize the Restic Repository

Run the script to initialize the repository.

sudo bash /etc/restic.d/.restic.sh

Uncomment the Init repository line in the script (Option 1) and re-run the script to initialize:

restic -r "$RESTIC_REPOSITORY/$SERVER_NAME" init --password-file "/var/app/secret/.restic-password"
Code language: JavaScript (javascript)

Step 5: Perform a Backup

To perform a backup, ensure the Backup section (Option 2) in the script is uncommented, then execute:

sudo bash /etc/restic.d/.restic.sh

The backup will store data from /var/app to s3://bucket-osaka-sandbox/vm-osaka-1 with the tag vm-osaka-1.

Step 6: List Snapshots

To list snapshots, uncomment the List snapshots line (Option 3) and run the script:

sudo bash /etc/restic.d/.restic.sh

Step 7: Perform Housekeeping

Housekeeping removes old backups and optimizes the repository. Uncomment the Housekeeping line (Option 4) and run the script:

sudo bash /etc/restic.d/.restic.sh

This setup keeps:

  • Last 7 snapshots
  • 7 daily snapshots
  • 4 weekly snapshots
  • 6 monthly snapshots

Step 8: Automate Backups with Systemd

To schedule backups, create a systemd service and timer.

Create the Systemd Service
sudo vi /etc/systemd/system/restic-backup.service

Add the following:

[Unit]
Description=Restic Backup Service
Wants=restic-backup.timer

[Service]
Type=oneshot
ExecStart=/bin/bash /etc/restic.d/.restic.sh
Code language: JavaScript (javascript)
Create the Systemd Timer
sudo vi /etc/systemd/system/restic-backup.timer

Add the following:

[Unit]
Description=Run Restic Backup Daily

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true

[Install]
WantedBy=timers.target
Code language: JavaScript (javascript)

Enable and start the timer:

sudo systemctl enable restic-backup.timer
sudo systemctl start restic-backup.timer
Code language: CSS (css)

Summary

With this setup, Restic will securely back up your files to Wasabi S3 storage. The use of subdirectories and tags makes it easy to manage backups for multiple virtual machines.

Automating the process with systemd ensures your data remains secure with minimal effort.