Automate restic backup to S3/backblaze using a systemd service

This assumes that you want to backup a location on the system such as /mnt/backup to a S3 compatible storage such backblaze.

.env file

Create a file such as restick-backup.env to store your sensitive data

AWS_ACCESS_KEY_ID=YOUR-KEY-ID
AWS_SECRET_ACCESS_KEY=YOUR-SECRET-ACCESS
AWS_DEFAULT_REGION=us-west-004
RESTIC_PASSWORD=THE-PASSWORD-FOR-RESTIC-REPO-ENCRYPTION
RESTIC_REPOSITORY=s3:https://s3.us-west-004.backblazeb2.com/YOUR-BUCKET
RESTIC_COMPRESSION=max
GOMAXPROCS=2
BACKUP_DIR=/mnt/backups
SNAPSHOT_TO_KEEP=7

Change the values so suit your environment and needs.

systemd service

Now create a service such as restic-backup.service with content similar to:

[Unit]
Description=Restic backblaze Backup Service
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
Environment="PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
Environment="RESTIC_CACHE_DIR=/var/cache/restic"
EnvironmentFile=-/opt/homelab-scripts/scripts/pbs-scripts/restic-backup.env
ExecStartPre=/bin/sh -c 'echo "Starting pre-execution" && mkdir -p ${RESTIC_CACHE_DIR} && echo "Cache directory created"'
ExecStartPre=/bin/sh -c 'echo "Unlocking repository" && /usr/bin/restic unlock'
ExecStart=/bin/sh -c 'echo "Starting backup" && /usr/bin/restic backup $BACKUP_DIR'
ExecStart=/bin/sh -c 'echo "Starting forget" && /usr/bin/restic forget --keep-last $SNAPSHOT_TO_KEEP --prune'
# Hardening options
ProtectSystem=full
PrivateTmp=true
ProtectHome=read-only
NoNewPrivileges=true
ProtectControlGroups=true
ProtectKernelModules=true
ProtectKernelTunables=true
PrivateDevices=true
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
MemoryDenyWriteExecute=true
RestrictRealtime=true
[Install]
WantedBy=multi-user.target

This assumes you want to prune as well, adjust as per your need. Also ensure restic-backup.env path is correctly set.

Now copy or symlink this file in /etc/systemd/system/restic-backup.service Then reload systemd daemon

systemctl daemon-reload

Now you can run this service by

systemctl start restic-backup.service

You can monitor its status in real-time by

journalctl -u restic-backup.service -f

Creating a systemd timer to run this service automatically

Instead of a cronjob you can now use a systemd timer to run this service automatically.

Create a file /etc/systemd/system/restic-backup.timer

[Unit]
Description=Run Restic Backup daily at 5:00 AM
[Timer]
OnCalendar=*-*-* 05:00:00
Persistent=true
Unit=restic-backup.service
[Install]
WantedBy=timers.target

This particular example would run the service every morning at 5AM.

Then enable and start the timer:

systemctl enable restic-backup.timer
systemctl start restic-backup.timer

View the status of the timer including its next run:

systemctl status restic-backup.timer

View all systemd timers active on the system:

systemctl list-timers

#restic #backup #systemd #homelab