Jump to content

Restic S3 Backup to Your Storage Box on PMSS

From Pulsed Media Wiki


Restic S3 Backup to Your Storage Box points Restic — an encrypted, deduplicating backup program — at a self-hosted S3 endpoint running on your own storage box. You run one small S3 server on the box, then any machine with the restic binary backs up to it over the S3 API: encrypted before it leaves the source, deduplicated so repeats cost almost nothing, and restorable to the byte. The repository lives on disk you already pay for, in Pulsed Media's Finnish datacenters, with no per-request and no egress fees.

The other S3 pages show how to run an endpoint; this one shows how to use one for the job most people actually want a box for — backups.

When to back up over S3

You can already reach a storage box over SFTP and rsync, and for a plain file copy those are fine. Reach for Restic-over-S3 when you want the things a raw copy does not give you: client-side encryption (the box — and therefore we — only ever sees ciphertext), deduplication and snapshots (each backup is a point-in-time snapshot sharing unchanged data with the others, so history is cheap), and a verified restore (Restic checks integrity on the way back). Restic speaks S3 natively, so an endpoint on your box is a first-class Restic repository — no third-party cloud, no egress bill.

What you need

Two things:

  • An S3 endpoint on your box. The simplest is rclone serve s3 — pre-installed, one command — which is what the walkthrough below uses and was tested against. Note that rclone's S3 server is officially marked experimental: it handled this backup and restore flawlessly and is fine for a backup target, but if you want the most battle-tested repository for critical data, MinIO and versitygw are fuller S3 servers and work as Restic repositories just as well; see the benchmarks if throughput matters to you.
  • The restic binary on the machine you back up FROM. It is a single static binary; install it from your package manager or the releases page.

The backup, verified

Everything below was run end to end on a Pulsed Media storage box: the endpoint started, a repository was created in it, data was backed up, and the restore came back byte-identical (verified by SHA-256).

A real Restic backup to a self-hosted S3 endpoint on a storage box: init, backup, snapshot, then a restore whose bytes match the original.

Start the endpoint (non-default port, bound to localhost) and point Restic at it. The repository password is separate from the S3 access key — it is what encrypts your data, and only you hold it: 

# on the box: start a one-command S3 endpoint (pick a high, non-default port)
rclone serve s3 --addr 127.0.0.1:47021 --auth-key 'MYKEY,MYSECRET' ~/s3-bucket &

# tell restic where the repo is and how to reach it
export AWS_ACCESS_KEY_ID=MYKEY
export AWS_SECRET_ACCESS_KEY=MYSECRET
export RESTIC_REPOSITORY="s3:http://127.0.0.1:47021/backups"
export RESTIC_PASSWORD="a-strong-repo-passphrase"   # this encrypts everything — keep it safe

Create the repository, back up a directory, and list the snapshot: 

$ restic init
created restic repository 71ed1f9380 at s3:http://127.0.0.1:47021/backups

$ restic backup ~/mydata
Files:           2 new,     0 changed,     0 unmodified
Added to the repository: 1.002 MiB (1.002 MiB stored)
processed 2 files, 1.000 MiB in 0:00
snapshot 76379fa6 saved

$ restic snapshots
ID        Time                 Host        Paths                  Size
76379fa6  2026-08-14 10:35:02  your-box    /home/you/mydata       1.000 MiB

Restore it — Restic rebuilds the files under the target you give it, and confirms the count and size: 

$ restic restore latest --target ~/restored
restoring snapshot 76379fa6 ... to /home/you/restored
Summary: Restored 6 files/dirs (1.000 MiB) in 0:00

Restic restores each file under its original absolute path beneath the target, so the data from /home/you/mydata lands at ~/restored/home/you/mydata. In this test the restored tree was byte-for-byte identical to the original (matching SHA-256 on every file). Inside the bucket you will find Restic's own repository layout — config, data, index, keys, snapshots — never your plaintext files.

Keep it running

  • Schedule it. Put the export lines and restic backup in a small script and run it from cron. Add restic forget --keep-daily 7 --keep-weekly 4 --prune to age out old snapshots and reclaim space.
  • Survive a migration. The endpoint's raw address changes if we ever move your service. Point RESTIC_REPOSITORY at your service permalink (s3:http://<your-label>.mcx.fi:47021/backups) instead of the server name, and scheduled jobs keep working after a move.
  • Off the box, too. The same repository works from your laptop or another server — install restic there, point it at the same endpoint (over the permalink, with TLS for anything crossing the network), and back up many machines into one deduplicated repo.

Security

Restic encrypts on the client, before anything is sent, so the box stores only ciphertext — the repository password never leaves your machine and is not recoverable if lost. Keep the S3 endpoint bound to 127.0.0.1 (or behind TLS on your permalink) rather than exposed, and keep the repository passphrase somewhere separate from the S3 keys: the keys reach the bucket, the passphrase decrypts the data, and you want to lose neither.

See also

Retrieved from "https://wiki.pulsedmedia.com/index.php?title=Restic_S3_Backup_to_Your_Storage_Box_on_PMSS&oldid=1004628"