Part 4: Store files

17. Automatic backups#

What you'll do: copy /srv/files to the backup drive every night, keeping older versions, so a deleted or damaged file can be brought back. Time: 30 minutes. Uses restic, a backup tool that encrypts and keeps versions.

flowchart LR
  F["/srv/files<br/>(drive 1)"] -- "every night 02:30" --> R["restic"]
  R --> B["/srv/backup/restic<br/>(drive 2)<br/>7 daily · 4 weekly · 6 monthly versions"]

Copying is not a backup until you've restored from it

Step 6 (test a restore) is not optional.

Step 1: Install#

Type on: the server

sudo apt install restic

Step 2: Create the backup password#

Type on: the server

sudo nano /root/restic-password

Type a long random password on one line, save and exit. Also save it in your password manager. If you lose it, the backups can never be opened.

Type on: the server

sudo chmod 600 /root/restic-password

Step 3: Create the backup store on drive 2#

Type on: the server

sudo restic -r /srv/backup/restic --password-file /root/restic-password init

It should say created restic repository.

Step 4: First backup (by hand)#

Type on: the server

sudo restic -r /srv/backup/restic --password-file /root/restic-password backup /srv/files /etc

This backs up your files and the server's settings (/etc). The first run can take a while.

Type on: the server

sudo restic -r /srv/backup/restic --password-file /root/restic-password snapshots

You see one line per backup, with its date.

Step 5: Make it automatic#

Type on: the server

sudo nano /etc/cron.d/nightly-backup

Paste as one single line (it's long):

File: /etc/cron.d/nightly-backup

30 2 * * * root mountpoint -q /srv/backup && restic -r /srv/backup/restic --password-file /root/restic-password backup /srv/files /etc --quiet && restic -r /srv/backup/restic --password-file /root/restic-password forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune --quiet >> /var/log/nightly-backup.log 2>&1

What it means: every night at 02:30, if the backup drive is plugged in, back up, then keep 7 daily, 4 weekly and 6 monthly versions and delete older ones.

Step 6: Test a restore (important)#

Restore one file into a test folder (never directly over your real files):

Type on: the server

sudo restic -r /srv/backup/restic --password-file /root/restic-password restore latest --target /tmp/restore-test
ls /tmp/restore-test/srv/files

Your files should be there. Open one to check it. Then clean up:

Type on: the server

sudo rm -r /tmp/restore-test

Step 7: Check it ran (the next day)#

Type on: the server

sudo restic -r /srv/backup/restic --password-file /root/restic-password snapshots

There should be a new line dated last night.

Even safer: a copy outside your home

Fire or theft would take both drives. restic can also send an encrypted copy to cloud storage (e.g. Backblaze B2). Search "restic Backblaze B2" when you're ready.

Done when:

A restore test brought back real files
The next day, snapshots shows a new nightly backup
The backup password is in your password manager

The server part is finished. Keep it healthy with the Monthly health check.

Next: 18. The AI part