159 lines
3.5 KiB
Markdown
159 lines
3.5 KiB
Markdown
# Restic System Backup – Konfiguration & Wiederherstellung
|
||
|
||
Dieses Repository enthält die Konfiguration für automatisierte **System-Backups mit Restic**,
|
||
inklusive **systemd-Service**, **Timer** und **Backup-Skript**.
|
||
Das Setup nutzt **rclone** als Backend (z. B. Nextcloud).
|
||
|
||
---
|
||
|
||
## 1. Voraussetzungen
|
||
|
||
### 1.1 Benötigte Pakete installieren
|
||
Als Root ausführen:
|
||
|
||
```bash
|
||
pacman -S restic rclone fuse jq curl
|
||
```
|
||
|
||
1.2 rclone als Root konfigurieren (wichtig!)
|
||
Da das Backup als root läuft, muss rclone auch im Root-Kontext konfiguriert sein:
|
||
|
||
```bash
|
||
sudo -i
|
||
rclone config
|
||
```
|
||
Remote testen:
|
||
|
||
```bash
|
||
rclone lsd Cloud.Michaelis.Digital:
|
||
```
|
||
2. Repository klonen und Dateien ablegen
|
||
```bash
|
||
git clone <DEINE-GIT-URL> /opt/backup-config
|
||
cd /opt/backup-config
|
||
```
|
||
Dateien installieren
|
||
```bash
|
||
# systemd Units
|
||
cp restic-backup.service /etc/systemd/system/
|
||
cp restic-backup.timer /etc/systemd/system/
|
||
```
|
||
|
||
# Backup-Skript
|
||
```bash
|
||
cp restic-backup /usr/local/bin/restic-backup
|
||
chmod 750 /usr/local/bin/restic-backup
|
||
```
|
||
Rechte setzen
|
||
```bash
|
||
chown ratatoskr:ratatoskr /usr/local/bin/restic-backup
|
||
chown root:root /etc/systemd/system/restic-backup.service
|
||
chown root:root /etc/systemd/system/restic-backup.timer
|
||
chmod 644 /etc/systemd/system/restic-backup.service
|
||
chmod 644 /etc/systemd/system/restic-backup.timer
|
||
```
|
||
|
||
3. Secrets anlegen
|
||
3.1 Restic-Passwortdatei
|
||
```bash
|
||
mkdir -p /home/ratatoskr
|
||
echo "DEIN_RESTIC_REPO_PASSWORT" > /home/ratatoskr/.restic-pass
|
||
chmod 600 /home/ratatoskr/.restic-pass
|
||
chown root:root /home/ratatoskr/.restic-pass
|
||
```
|
||
|
||
3.2 Umgebungsvariablen (empfohlen)
|
||
```bash
|
||
export RESTIC_REPOSITORY=rclone:Cloud.Michaelis.Digital:Restic/backup-repo
|
||
export RESTIC_PASSWORD_FILE=/home/ratatoskr/.restic-pass
|
||
```
|
||
|
||
Diese Variablen können z. B. in:
|
||
|
||
/etc/profile.d/restic.sh
|
||
|
||
oder im systemd-Service
|
||
|
||
gesetzt werden.
|
||
|
||
4. systemd aktivieren
|
||
|
||
```bash
|
||
systemctl daemon-reload
|
||
systemctl enable --now restic-backup.timer
|
||
```
|
||
|
||
Status prüfen:
|
||
|
||
```bash
|
||
systemctl status restic-backup.timer
|
||
journalctl -u restic-backup.service
|
||
```
|
||
|
||
5. Repository initialisieren (nur beim ersten Mal!)
|
||
⚠️ Nur ausführen, wenn das Repository noch nicht existiert!
|
||
|
||
```bash
|
||
restic -r rclone:Cloud.Michaelis.Digital:Restic/backup-repo init
|
||
```
|
||
|
||
6. Snapshots einsehen & mounten (Read-Only Restore)
|
||
6.1 Snapshots anzeigen
|
||
|
||
```bash
|
||
restic -r $RESTIC_REPOSITORY --password-file $RESTIC_PASSWORD_FILE snapshots
|
||
```
|
||
|
||
6.2 Snapshots mounten
|
||
```bash
|
||
mkdir -p /mnt/restic
|
||
restic -r rclone:Cloud.Michaelis.Digital:Restic/backup-repo --password-file /home/ratatoskr/.restic-pass mount /mnt/restic
|
||
```
|
||
|
||
Danach verfügbar unter:
|
||
|
||
```bash
|
||
/mnt/restic/snapshots/<SNAPSHOT_ID>/
|
||
```
|
||
|
||
Unmount:
|
||
|
||
```bash
|
||
fusermount -u /mnt/restic
|
||
```
|
||
7. Wiederherstellung
|
||
7.1 Einzelne Dateien oder Ordner
|
||
```bash
|
||
restic restore <SNAPSHOT_ID> \
|
||
--target /tmp/restore \
|
||
--include /home/ratatoskr/.ssh
|
||
```
|
||
|
||
7.2 ⚠️ Vollständiges System-Restore (NICHT empfohlen)
|
||
Ein Full-Restore auf ein laufendes System wird nicht empfohlen.
|
||
Stattdessen selektiv wiederherstellen.
|
||
|
||
8. Hinweise & Best Practices
|
||
rclone läuft als root
|
||
|
||
Snapshots immer zuerst mounten, dann selektiv kopieren
|
||
|
||
Kein blindes Restore von /etc oder /usr
|
||
|
||
Logs:
|
||
|
||
/var/log/restic-backup.log
|
||
|
||
journalctl -u restic-backup.service
|
||
|
||
Benachrichtigungen via ntfy sind im Script konfigurierbar
|
||
|
||
9. Minimaler Quickstart (erprobt)
|
||
```bash
|
||
Copy code
|
||
export RESTIC_REPOSITORY=rclone:Cloud.Michaelis.Digital:Restic/backup-repo
|
||
export RESTIC_PASSWORD_FILE=/home/ratatoskr/.restic-pass
|
||
|
||
restic snapshots
|
||
restic mount /mnt/restic
|
||
``` |