In order to follow a proper 3-2-1 backup strategy, you should have three copies of your important data: two local on different media types, and one off site. For local, I have a DAS with two 14TB drives configured in a RAID 1 array1 and a RPI5 with a 4TB drive (my most important data is around 1.5TB). For the off site copy, I opted to utilize Backblaze's B2 Cloud Storage and restic. Backblaze is a cloud storage provider, while Restic encrypts and chunks the files before upload. Restic is responsible for uploading, encryption/decryption, and deduplication.
To begin, I had to configure Backblaze.
Now for the local configuration. Create the directory /etc/restic
sudo mkdir /etc/restic
. /etc/ is the conventional spot for system-wide configs. This matters because the systemd service runs as root, not as the user. Create b2.env in this new directory and add the following:
B2_ACCOUNT_ID=your_account_ID
B2_ACCOUNT_KEY=your_applicationKey
RESTIC_REPOSITORY=b2:restic-ganymede:ganymede
RESTIC_PASSWORD_FILE=/etc/restic/password
Create a password with
openssl rand -base64 32 | sudo tee /etc/restic/password
. Be sure to store the password in a password manager - and even consider printing this out. This also goes into my password manager notes for Backblaze "restic repo encryption key". If this password is lost, you will not be able to decrypt the data. Then ensure the permissions are correct with
sudo chmod 600 /etc/restic/password /etc/restic/b2.env
.
Now intialize the first run:
sudo -i
set -a; source /etc/restic/b2.env; set +a
restic init
restic backup /path/to/photos /path/to/documents --verbose
For me, this took about 50 hours on my cable internet connection that tops out at 60Mbps upload to upload 1.2TB of data. Restic encrypts everything before it's uploaded to backblaze. B2 holds only opaque encrypted blobs so even if this data is compromised, nobody will be able to decrypt it. That said, if you lose your password, the data is not recoverable.
Once completed, the restic systemd service can be automated to run on a schedule. I've opted to do nightly at 3am. Run
sudo vim /etc/systemd/system/restic-backup.service
and add the following:
[Unit]
Description=Restic backup to B2
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
EnvironmentFile=/etc/restic/b2.env
ExecStart=/usr/bin/restic backup /path/to/photos /path/to/documents
ExecStart=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
Nice=10
IOSchedulingClass=idle
Then set up the time with
sudo vim /etc/systemd/system/restic-backup.timer
and add the following:
[Unit]
Description=Nightly restic backup
[Timer]
OnCalendar=*-*-* 03:00:00
RandomizedDelaySec=1800
Persistent=true
[Install]
WantedBy=timers.target
Enable the services with the following:
sudo systemctl daemon-reload
sudo systemctl enable --now restic-backup.timer
sudo systemctl list-timers restic-backup.timer
Lets say my home office goes up in flames and both my RAID1 array and Pi5 are destroyed. How do I recover? I'd start by installing restic and recreating the files:
/etc/restic/password
with the restic password and
/etc/restic/b2.env
with the Backblaze details (B2keyID, applicationKey, the bucket name, and the location of the restic password file). These details I've saved in my password manager. Both files get chmod 600. Then source the env file with
set -a; source /etc/restic/b2.env; set +a
and run
restic snapshots
to ensure it's accessible.
Create the directory where the restore will go, like
sudo mkdir -p /mnt/recovery
, and then restore with
restic restore latest --target /mnt/recovery
. Files land under their original path inside the target, so I'd see something like
/mnt/recovery/mnt/ganymede/
so plan accordingly.
It's also probably helpful to occasionally run
restic check
and do an actual test restore. I'd hate to have my home burn down then also discover that I lost all my important data!
And with that said, I can now sleep a little easier at night.
Thanks for reading. Feel free to send comments, questions, or recommendations to [email protected].