Restic

Restic is a fast and secure backup program. NixOS packages both restic client (program used to make backups) and restic-rest-server (one of the backends to store the backups remotely, "repositories" in restic parlance).

Installing

If you want to manually create restic backups, add restic to environment.systemPackages like so:

environment.systemPackages = with pkgs; [
  restic
];

Configuring

Restic

NixOS provides options to create a systemd timer and a service that will create the backups. See services.restic.backups options and "Backing up" in the restic documentation.

Note that NixOS includes an option to automatically create the repository by specifying    services.restic.backups.<name>.initialize = true;, as well as a wrapper to run restic in the same environment as the systemd jobs in services.restic.backups.<name>.createWrapper

Restic Rest Server

Restic Rest Server is one of the options for a remote repository. It can be installed by enabling the services.restic.server.enable option. By default the server requires either providing it with htpasswd file or running it without authentication. If provided, the username and password pairs htpassd file will be used to authenticate the restic clients connecting to the server. To run the server without authentication, you can pass the flag using the extraFlags option like this: services.restic.server.extraFlags = [ "--no-auth" ];

Using a htpasswd file

A htpasswd file must be created using the apacheHttpd package. Assuming that you do not already have this package, you may run the following to generate the file using nix shell. Note that the file will be hidden due to the "." at the start of the file.

$ nix shell nixpkgs#apacheHttpd -c htpasswd -B -c .htpasswd YOUR_USER

To declaratively use the htpasswd file you will need to use a secret management method. The following example uses sops-nix.

❄︎ configuration.nix

{config,inputs,...}:
{
  imports =
  [
    inputs.sops-nix.nixosModules.sops
  ];

  sops = {
    age.keyFile = "/home/YOUR_USER/.config/sops/age/keys.txt";
    defaultSopsFile = ./secrets.yaml;

    secrets."restic_server/password" = {
      owner = "restic";   
      group = "restic";
      mode  = "0400";
    };

  };

  services.restic.server = {
    enable = true;
    htpasswd-file = config.sops.secrets."restic_server/password".path;
  };

}

Connecting a client

If using a htpasswd file, you will need to pass the URL to the configuration in this format:

rest:https://user:pass@host:port/

The user will need to be the same user as used when you created the htpasswd file. If your password includes special characters you will need to percent-encode the characters within the URL. See additional information in the restic docs REST server section.

Below is an example of a configuration that connects to a remote repository using sops-nix for secrets.

❄︎ configuration.nix

{config, inputs, pkgs, ...}:
{
  imports =
  [
    inputs.sops-nix.nixosModules.sops
  ];
  
  sops = {
    age.keyFile = "/home/YOUR_USER/.config/sops/age/keys.txt";
    defaultSopsFile = ./secrets.yaml;
    secrets = {
      "restic/repo_password" = {};
      "restic/server_url" = {};
    };
  };
  
  # For debugging
  environment.systemPackages = with pkgs; [
    restic
  ];


  services.restic.backups.restic_repo_example = {
    initialize = true;
    paths = [
      "/home/YOUR_USER"
    ];
    pruneOpts = [
      "--keep-daily 7"
      "--keep-weekly 5"
      "--keep-monthly 12"
      "--keep-yearly 75"
    ];
    timerConfig = {
      OnCalendar = "daily";
      Persistent = true;
    };
    
    # Encryption key for repository
    passwordFile = config.sops.secrets."restic/repo_password".path;

    # Server URL
    repositoryFile = config.sops.secrets."restic/server_url".path;

  };

}

Security Wrapper

If you want to back up your system without running restic as root, you can create a user and security wrapper to give restic the capability to read anything on the filesystem as if it were running as root. The following will create the wrapper at /run/wrappers/bin/restic:

❄︎ configuration.nix

{  
  users = {
    users.restic = {
      group = "restic";
      isSystemUser = true;
    };
    groups.restic = {};
  };

  security.wrappers.restic = {
    source = lib.getExe pkgs.restic;
    owner = "restic";
    group = "restic";
    permissions = "500"; # or u=rx,g=,o=
    capabilities = "cap_dac_read_search+ep";
  };
}

Note that you will have to set your Restic configuration to use the wrapper using the services.restic.backups.<name>.package option, for example :

❄︎ configuration.nix

{  
  services.restic.backups.foo = {
    # ...
    user = "restic";
    package = pkgs.writeShellScriptBin "restic" ''
      exec /run/wrappers/bin/restic "$@"
    '';
  };
}