Backup (restic)

Daily backup with restic to SFTP, S3, a REST server or a local path – /etc, /root, /var/lib, the app's data and database dumps. Target: backup_repository in /etc/iac/settings.env

backup LXCVM

Add to a guest

In the guest as root – container and VM alike:

update --add-modules backup

Runs a normal update and installs the module on the way.

From the Proxmox node, without logging in:

pct exec <ID> -- update --add-modules backup   # container
ssh root@<IP> update --add-modules backup

Choose when creating a guest

Without a dialog, on the Proxmox node:

IAC_NONINTERACTIVE=1 var_modules=auto-update,backup \
  bash -c "$(curl -fsSL https://iac.heyer.systems/<app>/ct.sh)"

var_modules replaces the app's preselection – keep auto-update in the list if you want it. Interactive: choose “advanced” in the dialog, or tick the module in the generator on the app page.

Remove

update --remove-modules backup

Removes the module's packages, services, firewall rules and configuration again. Data stays.

Details

Backs up the guest every day with restic: /etc, /root, /home, /srv, /var/lib, the app’s data and – if active – PostgreSQL and MariaDB as a dump. It keeps 7 daily, 4 weekly and 6 monthly snapshots.

Set the target

After adding the module only the target is missing, in /etc/iac/settings.env:

backup_repository=sftp:[email protected]:/srv/restic/myhost     # SFTP (SSH key of root)
backup_repository=s3:https://s3.example/bucket/myhost             # S3
backup_repository=rest:https://backup.example/myhost              # restic REST server

Credentials, e.g. for S3, go into /etc/iac/backup.env (AWS_ACCESS_KEY_ID=…, AWS_SECRET_ACCESS_KEY=…).

Use it

iac-backup                                          # back up now (otherwise automatically at night)
iac-backup snapshots                                # existing snapshots
iac-backup restore latest --target /root/restore    # restore

Keep backup_password from /etc/iac/settings.env in a safe place! The module generates it once per guest. Without this password no backup can be read – not even when the guest is lost.

More paths: /etc/iac/backup.local.paths (one path per line). When the module is removed, the repository, the password and the last dumps stay.