Backups to a remote object store

A backup you cannot restore is a decoration. Restic encrypts client-side, deduplicates, and restores single files or whole trees — and it works with any S3-compatible store, including ones you run yourself on a second NoctisNode box.

Init

apt install -y restic
export AWS_ACCESS_KEY_ID=...
export AWS_SECRET_ACCESS_KEY=...
export RESTIC_REPOSITORY=s3:s3.example.com/bucket
restic init

Hourly cron

# /etc/cron.d/restic
0 * * * * root /usr/bin/restic backup /etc /home /var/www --quiet && /usr/bin/restic forget --keep-hourly 24 --keep-daily 14 --keep-monthly 12 --prune

Restore drills

• ▹Practice restoring a single file and a full directory before you need to.
• ▹Store the repository password outside the server it protects.
• ▹Test that the backup endpoint is in a different jurisdiction if that matters to your threat model.