Set up restic on goatrnet2 and goatrnet

[ismith]

Goatrnet2

• Install with sudo apt install restic
• Explicitly exclude dotfiles in /root and /home/pi, which may be sensitive
• for now, backup to the rpi itself; we're just demoing, and work laptop can't access backblaze.com, so setting that account up is a step for later
• set up backblaze

Goatrnet

TBD from goatrnet2 notes

[ismith]

Exclude dotfiles in /root and /home/pi; they're likely to be more sensitive.

sudo mkdir -p /etc/restic
sudo tee /etc/restic/excludes.txt > /dev/null <<'EOF'
# Volatile data not worth backing up
/var/cache/*
/var/tmp/*
/var/log/journal/*
/swapfile
/lost+found

# Don't backup the backups, that's just recursive
/var/backups/restic-*

# Sensitive dotfiles — issue #21
/root/.*
/home/pi/.*
EOF

[ismith]

Configure pi with passwords, and allow pi user to run restic as root

sudo tee /root/.restic-password > /dev/null <<'EOF'
PASTE-YOUR-REPO-PASSWORD-HERE
EOF
sudo chmod 600 /root/.restic-password

# allow user 'pi' to run restic as root non-interactively
RESTIC=$(which restic)   # usually /usr/bin/restic
echo "pi ALL=(root) NOPASSWD: $RESTIC" | sudo tee /etc/sudoers.d/restic
sudo chmod 440 /etc/sudoers.d/restic
exit

[ismith]

for now, backup to the rpi itself; we're just demoing, and work laptop can't access backblaze.com, so setting that account up is a step for later

init the repo

sudo restic -r /var/backups/restic-goatrnet --password-file /root/.restic-password init

Backup script

sudo tee /usr/local/bin/backup-goatrnet > /dev/null <<'EOF'
#!/usr/bin/env bash
set -euo pipefail
export RESTIC_REPOSITORY=/var/backups/restic-goatrnet
export RESTIC_PASSWORD_FILE=/root/.restic-password

restic backup --one-file-system \
  --exclude-file /etc/restic/excludes.txt \
  "$@" \
  / /boot/firmware

# This would make sense if we were running nightly backups, but we're not - more tag/event based
# restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
EOF
sudo chmod +x /usr/local/bin/backup-goatrnet

Change sudoers file to just that script

echo 'pi ALL=(root) NOPASSWD: /usr/local/bin/backup-goatrnet' | sudo tee /etc/sudoers.d/restic
sudo chmod 440 /etc/sudoers.d/restic

To run a backup

sudo backup-goatrnet --tag some-tag

To list backups:

sudo restic -r /var/backups/restic-goatrnet --password-file /root/.restic-password snapshots

[ismith]

Goodies

install starship so shell prints cmd_duration:

pi in 🌐 goatrnet2 in ~ via 🐍 v3.13.5 
❯ sleep 3

pi in 🌐 goatrnet2 in ~ via 🐍 v3.13.5 took 3s 
❯ 

Note that the starship install may have interactive prompts for sudo password.

curl -sS https://starship.rs/install.sh | sh
echo 'eval "$(starship init bash)"' >> "$HOME/.bashrc"