How to use Restic with eazyBackup e3 Object Storage
Install Restic, connect it to eazyBackup e3 Object Storage, create an encrypted backup, and verify that it can be restored.
Restic is an encrypted, deduplicating backup tool. It encrypts your data before uploading it to e3 Object Storage, so you need the Restic repository password to read or restore a backup.
This guide configures Restic for the e3 S3-compatible endpoint:
https://s3.ca-central-1.eazybackup.comBefore you begin
You need:
An active e3 Object Storage service
An e3 access key and secret key for the owner of your bucket
A bucket dedicated to Restic, or an empty prefix in an existing bucket
Root or sudo access on the Linux host you want to back up
Do not lose or share your Restic repository password. eazyBackup cannot use your e3 access keys to decrypt a Restic repository. Store the password in an approved password manager or another secure recovery location.
1. Create your e3 bucket and access key
Sign in at accounts.eazybackup.ca.
Open e3 Object Storage in the sidebar.
Open Access Keys and copy the Service URL. It should be
s3.ca-central-1.eazybackup.com.Click Create your first key or Create new key, confirm with your account password, and save the Access Key ID and Secret Access Key immediately.
Open Buckets and click Create Bucket.
Enter a globally unique bucket name using lowercase letters, numbers, and hyphens.
Choose the bucket owner, then click Create Bucket.
The access key must belong to the same owner as the bucket. A Root user key cannot access a User's bucket, and a User key cannot access Root or another User's bucket.
The secret access key is shown only once. Store it securely when you create or rotate the key. Rotating a Root key revokes the previous key immediately.
For a more detailed portal walkthrough, see Create your first key and bucket. You can also review the canonical Connection details.
2. Install Restic
On Ubuntu or Debian:
For the latest upstream release or another operating system, download the appropriate package from the official Restic releases. Verify the published checksum before installing it.
3. Create a protected configuration
This example keeps the configuration outside /root, so a backup of /root does not include your credentials. Replace every placeholder before continuing.
Add the following to /etc/restic/e3.env:
The /restic suffix is an optional repository prefix. Keep it if the bucket may contain other data. Omit it only when the bucket is reserved exclusively for this Restic repository.
Restrict the configuration file and create the cache directory:
Never commit this file to source control or paste real keys and passwords into a ticket, shell history, or chat.
4. Initialize the repository
Load the protected configuration and initialize the repository once:
The s3.bucket-lookup=dns option tells Restic to use virtual-hosted-style bucket addressing, where the bucket name is part of the hostname. This matches the recommended addressing style for e3 Object Storage and the style commonly used by AWS S3.
If the repository has already been initialized, do not run init again. Confirm that Restic can read it:
Type exit when you are ready to leave the root shell.
5. Optional convenience command
You can use small wrapper to keep you from having to retype the endpoint options.
Add:
Make sure to protect this:
Now on our examples will use restic-e3. If you skip the wrapper, first source /etc/restic/e3.env, then add the two -o s3... options shown above to each Restic command.
6. Create a backup
Back up a directory:
Back up /root without including any other filesystems mounted inside it
To back up the root filesystem while excluding temporary and virtual filesystems:
Avoid backing up a Restic cache directory or any file containing credentials. Run the same backup a second time to see deduplication in action. Unchanged files should be reported as unmodified, with very little new data uploaded.
7. Schedule a daily backup with systemd
Restic does not include a built-in scheduler. On Ubuntu and Debian, you can use a systemd timer to run backups automatically. This example backs up /home every day at 2:00 AM.
This example uses the restic-e3 wrapper from step 5. Create that wrapper before continuing.
First, create the service:
Add:
Change /home in ExecStart if you want to back up a different path. You can also add the exclusions used in step 6.
Next, create the timer:
Add:
Persistent=true runs a missed backup after the computer starts again. A systemd service cannot start a second copy while the first copy is still running, which can help prevent overlapping backups.
Load the new units and enable the timer:
Confirm when the next backup will run:
Test the backup service now instead of waiting until 2:00 AM:
Review recent backup logs:
Run the service manually and confirm that it creates a new snapshot before relying on the schedule.
8. Inspect and test a restore
List snapshots and view the size of the latest snapshot:
View paths in a snapshot:
Restore the latest snapshot to a new, empty directory:
For a smaller test restore of one directory:
Review the restored permissions and content before copying anything back into a live path. To restore a different snapshot, replace latest with an ID from restic-e3 snapshots.
9. Verify backup health
Run a metadata and repository structure check regularly:
To also read and verify a random sample of encrypted backup data:
For the most thorough check, read all pack data. This can take a while and can download a large amount of data:
Periodically perform a test restore and compare the restored files with the originals. A successful check confirms repository consistency. A restore test also confirms that your recovery steps work.
10. Set retention and maintain the repository
Preview a retention policy before deleting snapshots:
Apply the policy and reclaim unreferenced data:
For a non-destructive preview while troubleshooting storage usage:
Use forget and prune carefully. They can permanently remove snapshots and unreferenced backup data.
For more Restic commands and scheduling, see the official Restic documentation.
Last updated