Learning Restic - Restic on Servers/Containers

#Introduction

In episode 11 you have a verification ritual. Now it is time to place restic in the environment where it is needed most: production servers and containers. In the Kubernetes world, backup is not a manual terminal command — it is a container that lives alongside the application.

This episode covers two directions: restic as a client inside a container, and restic as a server (rest-server) serving many hosts.

#Restic in a Container: The Official Image

The official restic/restic image offers one-shot execution:

docker run --rm \
  -e RESTIC_REPOSITORY=/data \
  -e RESTIC_PASSWORD_FILE=/run/secrets/restic-pass \
  -v /home/user:/data/to-backup:ro \
  -v /backup/restic:/data \
  -v /etc/restic:/etc/restic:ro \
  restic/restic backup /data/to-backup

• --rm: the container is discarded when done — clean for cron.
• Volume -v /home/user:/data/to-backup:ro: the data source is mounted read-only.
• Volume /backup/restic:/data: the local repository.
• Password from a secret file, not a literal env on the command line.

#Storing the Password as a Secret

printf '%s' "$RESTIC_PASS" | docker secret create restic-pass -

Then use RESTIC_PASSWORD_FILE=/run/secrets/restic-pass — a much safer practice than -e RESTIC_PASSWORD=....

#The Sidecar Pattern in Kubernetes

The most common pattern: a sidecar — a backup container running alongside the application in the same Pod, backing up the same volume:

containers:
  - name: app
    image: myapp:1.0
    volumeMounts:
      - name: data
        mountPath: /var/lib/myapp
  - name: restic-backup
    image: restic/restic:0.19.1
    command: ["sh", "-c", "while true; do restic backup /var/lib/myapp --tag app; sleep 3600; done"]
    env:
      - name: RESTIC_REPOSITORY
        value: "s3:https://minio.ns.svc/bucket"
    envFrom:
      - secretRef:
          name: restic-credentials
    volumeMounts:
      - name: data
        mountPath: /var/lib/myapp

Both containers share the data volume — the sidecar sees exactly the same files as the application. Wrap this in a CronJob if you want execution separate from the application Pod:

schedule: "0 2 * * *"
jobTemplate:
  spec:
    template:
      spec:
        restartPolicy: Never
        containers:
          - name: restic-backup
            image: restic/restic:0.19.1
            command: ["restic", "backup", "/var/lib/myapp", "--tag", "app-daily"]

#rest-server: A Multi-Host Backup Server

When many hosts need one centralized backup point without granting shell access, build a rest-server. Install:

go install github.com/restic/rest-server/cmd/rest-server@latest
rest-server --version

Run it behind a reverse proxy with HTTPS (e.g. Caddy/nginx) and htpasswd authentication:

sudo mkdir -p /srv/restic
sudo htpasswd -cb /etc/restic/htpasswd backupuser 'kata-sandi-kuat'
sudo chown restic:restic /srv/restic

/etc/systemd/system/rest-server.service

[Unit]
Description=Restic REST Server
After=network.target
 
[Service]
User=restic
ExecStart=/usr/local/bin/rest-server --path /srv/restic --listen :8000 \
  --htpasswd /etc/restic/htpasswd --tls --append-only
Restart=always

Note the flags: --htpasswd for user authentication, --tls for internal TLS (or terminate at the proxy), and --append-only for anti-ransomware protection (details in episode 14).

Clients then back up to the URL:

restic -r rest:https://backup.example.com/repo-app \
  --username backupuser --password-file /etc/restic/.restic-pass \
  backup /var/www

#Conclusion

• The restic/restic image can run one-shot (--rm) for container cron.
• Mount data read-only; password via RESTIC_PASSWORD_FILE/secret.
• The sidecar pattern backs up the volume shared with the application; a CronJob for separate schedules.
• rest-server serves many hosts over HTTP(S) without shell access.
• Htpasswd + TLS + --append-only is the foundation of rest-server configuration.
• Clients only need -r rest:https://... plus username/password.

In the next episode, episode 13, we open up the most secretive layer: encryption & keys — AES-256-CTR + Poly1305-AES as the integrity proof (MAC), how the master key and repo key work, key management with restic key list/add/remove/passwd, and a strong passphrase policy.