{"article":{"slug":"implementing-a-3-2-1-backup-strategy-with-restic-and-backblaze-b2","title":"Implementing a 3-2-1 Backup Strategy with restic and Backblaze B2","subtitle":null,"summary":"In order to follow a proper 3-2-1 backup strategy, you should have three copies of your important data: two local on different media types, and one off site. For local, I have a [DAS]() with two 14TB drives configured in a RAID 1 array[1]() with two 14TB drives configured in a RAID 1 array[1]() and a RPI5 with a 4TB drive (my most important data is around 1.5TB). For the off site copy, I opted to utilize Backblaze's B2 Cloud Storage and restic. Backblaze is a cloud storage provider, while Restic encrypts and chunks the files before upload. Restic is responsible for uploading, encryption/decryption, and deduplication. \n\nTo begin, I had to configure Backblaze.\n\nNow for the local configuration. Create the directory /etc/restic \n \n \n sudo mkdir /etc/restic\n\n. /etc/ is the conventional spot for system-wide configs. This matters because the systemd service runs as root, not as the user. Create b2.env in this new directory and add the following: \n \n \n B2_ACCOUNT_ID=your_account_ID\n B2_ACCOUNT_KEY=your_applicationKey\n RESTIC_REPOSITORY=b2:restic-ganymede:ganymede\n RESTIC_PASSWORD_FILE=/etc/restic/password\n \n\nCreate a password with \n \n \n openssl rand -base64 32 | sudo tee /etc/restic/password\n\n. Be sure to store the password in a password manager - and even consider printing this out. This also goes into my password manager notes for Backblaze \"restic repo encryption key\". If this password is lost, you will not be able to decrypt the data. Then ensure the permissions are correct with \n \n \n sudo chmod 600 /etc/restic/password /etc/restic/b2.env\n\n. \n\nNow intialize the first run:\n \n \n sudo -i\n set -a; source /etc/restic/b2.env; set +a\n restic init\n restic backup /path/to/photos /path/to/documents --verbose\n \n\nFor me, this took about 50 hours on my cable internet connection that tops out at 60Mbps upload to upload 1.2TB of data. Restic encrypts everything before it's uploaded to backblaze. B2 holds only opaque encrypted blobs so even if this data is compromised, nobody will be able to decrypt it. That said, if you lose your password, the data is not recoverable.\n\nOnce completed, the restic systemd service can be automated to run on a schedule. I've opted to do nightly at 3am. Run \n \n \n sudo vim /etc/systemd/system/restic-backup.service\n\nand add the following: \n \n \n [Unit]\n Description=Restic backup to B2\n After=network-online.target\n Wants=network-online.target\n \n [Service]\n Type=oneshot\n EnvironmentFile=/etc/restic/b2.env\n ExecStart=/usr/bin/restic backup /path/to/photos /path/to/documents\n ExecStart=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune\n Nice=10\n IOSchedulingClass=idle\n \n\nThen set up the time with \n \n \n sudo vim /etc/systemd/system/restic-backup.timer\n\nand add the following: \n \n \n [Unit]\n Description=Nightly restic backup\n \n [Timer]\n OnCalendar=*-*-* 03:00:00\n RandomizedDelaySec=1800\n Persistent=true\n \n [Install]\n WantedBy=timers.target\n \n\nEnable the services with the following: \n \n \n sudo systemctl daemon-reload\n sudo systemctl enable --now restic-backup.timer\n sudo systemctl list-timers restic-backup.timer\n \n\nLets say my home office goes up in flames and both my RAID1 array and Pi5 are destroyed. How do I recover? I'd start by installing restic and recreating the files: \n \n \n /etc/restic/password\n\nwith the restic password and \n \n \n /etc/restic/b2.env\n\nwith the Backblaze details (B2keyID, applicationKey, the bucket name, and the location of the restic password file). These details I've saved in my password manager. Both files get chmod 600. Then source the env file with \n \n \n set -a; source /etc/restic/b2.env; set +a\n\nand run \n \n \n restic snapshots\n\nto ensure it's accessible. \n\nCreate the directory where the restore will go, like \n \n \n sudo mkdir -p /mnt/recovery\n\n, and then restore with \n \n \n restic restore latest --target /mnt/recovery\n\n. Files land under their original path inside the target, so I'd see something like \n \n \n /mnt/recovery/mnt/ganymede/\n\nso plan accordingly. \n\nIt's also probably helpful to occasionally run \n \n \n restic check\n\nand do an actual test restore. I'd hate to have my home burn down then also discover that I lost all my important data! \n\nAnd with that said, I can now sleep a little easier at night.\n\nThanks for reading. Feel free to send comments, questions, or recommendations to [[email protected]]().","body_html":"

In order to follow a proper 3-2-1 backup strategy, you should have three copies of your important data: two local on different media types, and one off site. For local, I have a DAS with two 14TB drives configured in a RAID 1 array1 and a RPI5 with a 4TB drive (my most important data is around 1.5TB). For the off site copy, I opted to utilize Backblaze's B2 Cloud Storage and restic. Backblaze is a cloud storage provider, while Restic encrypts and chunks the files before upload. Restic is responsible for uploading, encryption/decryption, and deduplication.

\n

To begin, I had to configure Backblaze.

\n

Now for the local configuration. Create the directory /etc/restic

\n
sudo mkdir /etc/restic
\n

. /etc/ is the conventional spot for system-wide configs. This matters because the systemd service runs as root, not as the user. Create b2.env in this new directory and add the following:

\n
B2_ACCOUNT_ID=your_account_ID\nB2_ACCOUNT_KEY=your_applicationKey\nRESTIC_REPOSITORY=b2:restic-ganymede:ganymede\nRESTIC_PASSWORD_FILE=/etc/restic/password
\n

Create a password with

\n
openssl rand -base64 32 | sudo tee /etc/restic/password
\n

. Be sure to store the password in a password manager - and even consider printing this out. This also goes into my password manager notes for Backblaze "restic repo encryption key". If this password is lost, you will not be able to decrypt the data. Then ensure the permissions are correct with

\n
sudo chmod 600 /etc/restic/password /etc/restic/b2.env
\n

.

\n

Now intialize the first run:

\n
sudo -i\nset -a; source /etc/restic/b2.env; set +a\nrestic init\nrestic backup /path/to/photos /path/to/documents --verbose
\n

For me, this took about 50 hours on my cable internet connection that tops out at 60Mbps upload to upload 1.2TB of data. Restic encrypts everything before it's uploaded to backblaze. B2 holds only opaque encrypted blobs so even if this data is compromised, nobody will be able to decrypt it. That said, if you lose your password, the data is not recoverable.

\n

Once completed, the restic systemd service can be automated to run on a schedule. I've opted to do nightly at 3am. Run

\n
sudo vim /etc/systemd/system/restic-backup.service
\n

and add the following:

\n
[Unit]\nDescription=Restic backup to B2\nAfter=network-online.target\nWants=network-online.target\n\n[Service]\nType=oneshot\nEnvironmentFile=/etc/restic/b2.env\nExecStart=/usr/bin/restic backup /path/to/photos /path/to/documents\nExecStart=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune\nNice=10\nIOSchedulingClass=idle
\n

Then set up the time with

\n
sudo vim /etc/systemd/system/restic-backup.timer
\n

and add the following:

\n
[Unit]\nDescription=Nightly restic backup\n\n[Timer]\nOnCalendar=*-*-* 03:00:00\nRandomizedDelaySec=1800\nPersistent=true\n\n[Install]\nWantedBy=timers.target
\n

Enable the services with the following:

\n
sudo systemctl daemon-reload\nsudo systemctl enable --now restic-backup.timer\nsudo systemctl list-timers restic-backup.timer
\n

Lets say my home office goes up in flames and both my RAID1 array and Pi5 are destroyed. How do I recover? I'd start by installing restic and recreating the files:

\n
/etc/restic/password
\n

with the restic password and

\n
/etc/restic/b2.env
\n

with the Backblaze details (B2keyID, applicationKey, the bucket name, and the location of the restic password file). These details I've saved in my password manager. Both files get chmod 600. Then source the env file with

\n
set -a; source /etc/restic/b2.env; set +a
\n

and run

\n
restic snapshots
\n

to ensure it's accessible.

\n

Create the directory where the restore will go, like

\n
sudo mkdir -p /mnt/recovery
\n

, and then restore with

\n
restic restore latest --target /mnt/recovery
\n

. Files land under their original path inside the target, so I'd see something like

\n
/mnt/recovery/mnt/ganymede/
\n

so plan accordingly.

\n

It's also probably helpful to occasionally run

\n
restic check
\n

and do an actual test restore. I'd hate to have my home burn down then also discover that I lost all my important data!

\n

And with that said, I can now sleep a little easier at night.

\n

Thanks for reading. Feel free to send comments, questions, or recommendations to [email protected].

","headings":[]}}