restic on a small VPS, with one cron line

Three small machines back up into one restic repository on a storage box. The setup is boring on purpose: I want to be able to restore from it half asleep.

The repository

Created once, with the password in a file only root can read:

export RESTIC_REPOSITORY=sftp:backup@storage.example:restic
export RESTIC_PASSWORD_FILE=/root/.config/restic/password
restic init

The password file is also printed and kept in a drawer. A repository without its password is just noise.

The cron line

15 4 * * * root /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

backup.sh does three things: restic backup of /etc, /root and the data directories, restic forget --prune with the retention below, and on Sundays restic check --read-data-subset=5%, which reads a different random slice of the data each week.

Retention I can explain

restic forget --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --prune

A week of dailies, a month of weeklies, a year of monthlies. Anything cleverer and I would not remember why a particular snapshot is missing.

A restore test that runs itself

On the first of the month the script restores one random file from the latest snapshot into /tmp and compares it with the live copy. If they differ, or the restore fails, the log line starts with RESTORE FAILED and my log watcher sends me a message.

A backup that has never been restored from is a hope, not a backup.