Fedora - Automate backups with restic and systemd

Automate backups with restic and systemd

<div><p>Timely backups are important. So much so that <a href="https://restic.net/">backing up software</a> is a common topic of discussion, even <a href="https://fedoramagazine.org/?s=backup">here on the Fedora Magazine</a>. This article demonstrates how to automate backups with <strong>restic</strong> using only systemd unit files.</p>
<p>For an introduction to restic, be sure to check out our article <a href="https://fedoramagazine.org/use-restic-encrypted-backups/">Use restic on Fedora for encrypted backups</a>. Then read on for more details.</p>
<p> <span id="more-27506"></span> </p>
<p>Two systemd services are required to run in order to automate taking snapshots and keeping data pruned. The first service runs the <em>backup</em> command needs to be run on a regular frequency. The second service takes care of data pruning.</p>
<p>If you’re not familiar with systemd at all, there’s never been a better time to learn. Check out <a href="https://fedoramagazine.org/series/systemd-series/">the series on systemd here at the Magazine</a>, starting with this primer on unit files:</p>
<figure class="wp-block-embed is-type-rich is-provider-fedora-magazine">
<div class="wp-block-embed__wrapper">
<blockquote class="wp-embedded-content" data-secret="t4XltaCCoC"><p><a href="https://fedoramagazine.org/systemd-getting-a-grip-on-units/">systemd unit file basics</a></p></blockquote>
</div>
</figure>
<p>If you haven’t installed restic already, note it’s in the official Fedora repositories. To install use this command <a href="https://fedoramagazine.org/howto-use-sudo/">with sudo</a>:</p>
<pre class="wp-block-preformatted">$ sudo dnf install restic</pre>
<h2>Backup</h2>
<p>First, create the <em>~/.config/systemd/user/restic-backup.service</em> file. Copy and paste the text below into the file for best results.</p>
<pre class="wp-block-preformatted">[Unit]<br />Description=Restic backup service<br />[Service]<br />Type=oneshot<br />ExecStartPre=restic unlock<br />ExecStart=restic backup --verbose --one-file-system --tag systemd.timer $BACKUP_EXCLUDES $BACKUP_PATHS<br />ExecStartPost=restic forget --verbose --tag systemd.timer --group-by "paths,tags" --keep-daily $RETENTION_DAYS --keep-weekly $RETENTION_WEEKS --keep-monthly $RETENTION_MONTHS --keep-yearly $RETENTION_YEARS<br />EnvironmentFile=%h/.config/restic-backup.conf<br /></pre>
<p>This service references an environment file in order to load secrets (such as <em>RESTIC_PASSWORD</em>). Create the <em>~/.config/restic-backup.conf</em> file. Copy and paste the content below for best results. This example uses BackBlaze B2 buckets. Adjust the ID, key, repository, and password values accordingly.</p>
<pre class="wp-block-preformatted">BACKUP_PATHS="/home/rupert"<br />BACKUP_EXCLUDES="--exclude-file /home/rupert/.restic_excludes --exclude-if-present .exclude_from_backup"<br />RETENTION_DAYS=7<br />RETENTION_WEEKS=4<br />RETENTION_MONTHS=6<br />RETENTION_YEARS=3<br />B2_ACCOUNT_ID=XXXXXXXXXXXXXXXXXXXXXXXXX<br />B2_ACCOUNT_KEY=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br />RESTIC_REPOSITORY=b2:XXXXXXXXXXXXXXXXXX:/<br />RESTIC_PASSWORD=XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX<br /></pre>
<p>Now that the service is installed, reload systemd: <em>systemctl –user daemon-reload</em>. Try running the service manually to create a backup: <em>systemctl –user start restic-backup</em>.</p>
<p>Because the service is a <em>oneshot</em>, it will run once and exit. After verifying that the service runs and creates snapshots as desired, set up a timer to run this service regularly. For example, to run the <em>restic-backup.service</em> daily, create <em>~/.config/systemd/user/restic-backup.timer</em> as follows. Again, copy and paste this text:</p>
<pre class="wp-block-preformatted">[Unit]<br />Description=Backup with restic daily<br />[Timer]<br />OnCalendar=daily<br />Persistent=true<br />[Install]<br />WantedBy=timers.target<br /></pre>
<p>Enable it by running this command:</p>
<pre class="wp-block-preformatted">$ systemctl --user start restic-backup.timer</pre>
<h2>Prune</h2>
<p>While the main service runs the <em>forget</em> command to only keep snapshots within the keep policy, the data is not actually removed from the restic repository. The <em>prune</em> command inspects the repository and current snapshots, and deletes any data not associated with a snapshot. Because <em>prune</em> can be a time-consuming process, it is not necessary to run every time a backup is run. This is the perfect scenario for a second service and timer. First, create the file <em>~/.config/systemd/user/restic-prune.service</em> by copying and pasting this text:</p>
<pre class="wp-block-preformatted">[Unit]<br />Description=Restic backup service (data pruning)<br />[Service]<br />Type=oneshot<br />ExecStart=restic prune<br />EnvironmentFile=%h/.config/restic-backup.conf<br /></pre>
<p>Similarly to the main <em>restic-backup.service</em>, <em>restic-prune</em> is a oneshot service and can be run manually. Once the service has been set up, create and enable a corresponding timer at <em>~/.config/systemd/user/restic-prune.timer</em>:</p>
<pre class="wp-block-preformatted">[Unit]<br />Description=Prune data from the restic repository monthly<br />[Timer]<br />OnCalendar=monthly<br />Persistent=true<br />[Install]<br />WantedBy=timers.target<br /></pre>
<p>That’s it! Restic will now run daily and prune data monthly.</p>
<hr class="wp-block-separator" />
<p><em>Photo by&nbsp;</em><a href="https://unsplash.com/photos/JuFcQxgCXwA?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText"><em>Samuel Zeller</em></a><em>&nbsp;on&nbsp;</em><a href="https://unsplash.com/search/photos/archive?utm_source=unsplash&amp;utm_medium=referral&amp;utm_content=creditCopyText"><em>Unsplash</em></a><em>.</em></p>
</div>