Restic - Schnelles und sicheres Backup-Tool

Restic ist ein modernes Backup-Programm in Go geschrieben. Es bietet schnelle, verschlüsselte und deduplizierte Backups auf verschiedene Backends.

Warum Restic?

Vorteile

- Schnell (Go-basiert)
- Verschlüsselung standardmäßig
- Deduplizierung
- Viele Backends
- Einfache Bedienung
- Plattformübergreifend
- Aktive Entwicklung

Vergleich

Installation

Debian/Ubuntu

apt install restic

Aktuellste Version

# Via GitHub
wget https://github.com/restic/restic/releases/download/v0.16.4/restic_0.16.4_linux_amd64.bz2
bunzip2 restic_0.16.4_linux_amd64.bz2
mv restic_0.16.4_linux_amd64 /usr/local/bin/restic
chmod +x /usr/local/bin/restic

Self-Update

restic self-update

Repository initialisieren

Lokal

restic init --repo /backup/restic-repo

SFTP

restic init --repo sftp:user@backup-server:/backup/restic

Amazon S3

export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG..."

restic init --repo s3:s3.amazonaws.com/bucket-name

Backblaze B2

export B2_ACCOUNT_ID="xxxxxxxxxxxx"
export B2_ACCOUNT_KEY="K000xxxxxxxxxxxxxxx"

restic init --repo b2:bucket-name:/restic

MinIO/S3-kompatibel

restic init --repo s3:https://minio.example.de/bucket

REST Server

restic init --repo rest:https://user:pass@backup.example.de/

Backup erstellen

Einfaches Backup

restic -r /backup/restic-repo backup /home /etc

Mit Optionen

restic -r /backup/restic-repo backup \
    --verbose \
    --tag server1 \
    --exclude-caches \
    --exclude='*.tmp' \
    --exclude='.cache' \
    /home /etc /var/www

Exclude-Datei

# /etc/restic/excludes.txt
*.tmp
*.log
.cache
node_modules
.git
__pycache__

restic backup --exclude-file=/etc/restic/excludes.txt /home

Stdin-Backup

# Datenbank-Dump
mysqldump --all-databases | restic -r /backup/restic backup --stdin --stdin-filename mysql-dump.sql

Snapshots verwalten

Snapshots auflisten

restic -r /backup/restic snapshots

Nach Tags filtern

restic snapshots --tag server1

Snapshot-Details

restic -r /backup/restic stats
restic -r /backup/restic stats --mode files-by-contents

Dateien in Snapshot

restic -r /backup/restic ls latest
restic -r /backup/restic ls abc123de  # Snapshot-ID

Wiederherstellen

Kompletter Snapshot

restic -r /backup/restic restore latest --target /restore

Bestimmter Snapshot

restic -r /backup/restic restore abc123de --target /restore

Einzelne Dateien

restic restore latest --target /restore --include /home/user/wichtig.txt

Mit Pattern

restic restore latest --target /restore --include '*.conf'

Snapshot mounten

mkdir /mnt/restic
restic -r /backup/restic mount /mnt/restic

# Durchsuchen
ls /mnt/restic/snapshots/latest/

# Beenden mit Ctrl+C oder
fusermount -u /mnt/restic

Snapshots löschen

Einzelner Snapshot

restic -r /backup/restic forget abc123de

Mit Retention-Policy

restic -r /backup/restic forget \
    --keep-last 10 \
    --keep-daily 7 \
    --keep-weekly 4 \
    --keep-monthly 12 \
    --keep-yearly 2

Mit Prune (Daten löschen)

restic forget --keep-daily 7 --prune

Dry-Run

restic forget --keep-daily 7 --dry-run

Automatisierung

Backup-Skript

#!/bin/bash
# /usr/local/bin/restic-backup.sh

# Repository
export RESTIC_REPOSITORY="s3:s3.eu-central-1.amazonaws.com/backup-bucket"
export RESTIC_PASSWORD="verschluesselungs_passwort"
export AWS_ACCESS_KEY_ID="AKIAIOSFODNN7EXAMPLE"
export AWS_SECRET_ACCESS_KEY="wJalrXUtnFEMI/K7MDENG..."

# Logging
LOG=/var/log/restic-backup.log
exec >> $LOG 2>&1

echo "=== Backup gestartet: $(date) ==="

# Backup
restic backup \
    --verbose \
    --tag $(hostname) \
    --exclude-caches \
    --exclude-file=/etc/restic/excludes.txt \
    /home \
    /etc \
    /var/www \
    /var/lib/mysql

backup_exit=$?

# Alte Snapshots löschen
restic forget \
    --keep-daily 7 \
    --keep-weekly 4 \
    --keep-monthly 6 \
    --prune

forget_exit=$?

# Integrität prüfen (wöchentlich)
if [ $(date +%u) -eq 7 ]; then
    restic check
fi

echo "=== Backup beendet: $(date), Exit: $backup_exit ==="

Systemd-Timer

# /etc/systemd/system/restic-backup.service

[Unit]
Description=Restic Backup

[Service]
Type=oneshot
ExecStart=/usr/local/bin/restic-backup.sh

# /etc/systemd/system/restic-backup.timer

[Unit]
Description=Restic Backup Timer

[Timer]
OnCalendar=*-*-* 03:00:00
RandomizedDelaySec=1800
Persistent=true

[Install]
WantedBy=timers.target

systemctl enable restic-backup.timer
systemctl start restic-backup.timer

Passwort-Datei

# /etc/restic/password
mein_geheimes_passwort

chmod 600 /etc/restic/password

export RESTIC_PASSWORD_FILE=/etc/restic/password

REST-Server

Installation

# REST-Server für Restic
wget https://github.com/restic/rest-server/releases/download/v0.12.1/rest-server_0.12.1_linux_amd64.gz
gunzip rest-server_0.12.1_linux_amd64.gz
mv rest-server_0.12.1_linux_amd64 /usr/local/bin/rest-server
chmod +x /usr/local/bin/rest-server

Starten

# Ohne Authentifizierung
rest-server --path /backup/restic-data

# Mit Authentifizierung
rest-server --path /backup/restic-data --private-repos

# Mit TLS
rest-server --path /backup/restic-data --tls --tls-cert cert.pem --tls-key key.pem

Systemd-Service

# /etc/systemd/system/restic-rest-server.service

[Unit]
Description=Restic REST Server
After=network.target

[Service]
Type=simple
User=restic
ExecStart=/usr/local/bin/rest-server --path /backup/restic-data --private-repos
Restart=always

[Install]
WantedBy=multi-user.target

Client-Konfiguration

restic -r rest:https://user:pass@backup.example.de/repo init

Kompression (ab 0.14)

Kompression aktivieren

restic backup --compression auto /home

Kompressionsoptionen

Existierende Daten komprimieren

# Bei nächstem prune
restic prune --repack-uncompressed

Integrität prüfen

Schnelle Prüfung

restic -r /backup/restic check

Vollständige Prüfung

restic check --read-data

Teil der Daten prüfen

restic check --read-data-subset=10%

Mehrere Repositories

Kopieren zwischen Repos

restic -r /backup/source copy --repo2 /backup/target

Mit Passwörtern

restic -r /backup/source \
    --password-file /etc/restic/source-pass \
    copy \
    --repo2 /backup/target \
    --password-file2 /etc/restic/target-pass

Monitoring

Prometheus-Metriken

#!/bin/bash
# Nach Backup

PROM_FILE=/var/lib/prometheus/restic.prom

restic stats --json | jq -r '
    "restic_total_size " + (.total_size|tostring),
    "restic_total_file_count " + (.total_file_count|tostring)
' > $PROM_FILE

echo "restic_last_backup_timestamp $(date +%s)" >> $PROM_FILE

Healthcheck

# Am Ende des Backup-Skripts
if [ $backup_exit -eq 0 ]; then
    curl -fsS -m 10 https://hc-ping.com/your-uuid
fi

Troubleshooting

Lock entfernen

restic -r /backup/restic unlock

Cache löschen

restic cache --cleanup

Repository reparieren

restic -r /backup/restic recover
restic -r /backup/restic prune

Debug-Modus

restic -v backup /home
restic -vv backup /home  # Noch detaillierter

Zusammenfassung

Fazit

Restic ist ein ausgezeichnetes Backup-Tool für moderne Infrastrukturen. Die Geschwindigkeit und einfache Bedienung machen es ideal für automatisierte Backups. Die Verschlüsselung ist standardmäßig aktiv und schützt sensible Daten. Mit der breiten Backend-Unterstützung lassen sich flexible Backup-Strategien umsetzen. Der REST-Server ermöglicht zentrale Backup-Infrastrukturen.