backup

Backup service data to Backblaze B2 using restic.

docker pull ghcr.io/rogueoneecho/backup

Features

• Backs up SOURCE (default /srv/${NAME}/) with configurable exclusions
• Exports SQLite databases safely with integrity checks and VACUUM INTO
• Uploads files and database exports as one snapshot to Backblaze B2 via restic with encryption and deduplication
• Automatic retention policy: everything within 14 days, 4 weekly, 12 monthly
• Verifies backup integrity after each run
• Logs progress every 10 seconds; override with RESTIC_PROGRESS_FPS (updates per second)

Build

• amd64 and arm64 images available on GHCR
• Signed with Cosign via keyless Sigstore OIDC
• SBOM attestation in CycloneDX format
• Vulnerability scanned with Grype

Usage

See docker-compose.yml for an example.

Secrets

B2_APPLICATION_KEY, B2_APPLICATION_KEY_ID and RESTIC_PASSWORD can each be read from a file by setting <VAR>_FILE to its path, e.g. a compose secret:

services:
  backup:
    environment:
      RESTIC_PASSWORD_FILE: /run/secrets/restic_password
    secrets:
    - restic_password

secrets:
  restic_password:
    environment: RESTIC_PASSWORD

• Setting both <VAR> and <VAR>_FILE is an error
• Trailing newlines in the file are ignored

Exclusions

Optional /app/exclude lists one pattern per line, relative to SOURCE:

example-1
**/*.log

• Lines MUST NOT start with /
• Use ** to match at any depth
• ** patterns do not skip SQLite databases; databases are only skipped by patterns without **

Restore

Stop the service, remove any leftover -wal and -shm files, then restore the files and the database exports over them:

restic restore latest:/srv/test --host test --target /srv/test
restic restore latest:/app/sqlite --host test --target /srv/test

Releases and Changes

Releases and a full changelog are available via GitHub Releases.