Restic 备份系统部署与运维实战

一、概述

Restic 是一款现代化的备份工具，具有加密、去重、增量备份等特性。支持多种后端存储，包括本地磁盘、SFTP、S3、Azure、Google Cloud 等。

1.1 核心特性

  • 加密安全：使用 AES-256 加密，数据在传输和存储时都保持加密
  • 去重高效：基于内容寻址，相同数据只存储一次
  • 增量备份：只备份变化的数据，节省空间和时间
  • 多后端支持：本地、SFTP、S3、Azure、GCS、MinIO 等
  • 跨平台：支持 Linux、macOS、Windows、FreeBSD
  • 单二进制：无需依赖，部署简单

1.2 与其他备份工具对比

特性 Restic BorgBackup rsync
加密 内置 内置 需额外配置
去重 块级 块级 文件级
压缩 不支持 支持 不支持
后端 多种 主要本地/SFTP 本地/SSH
快照 支持 支持 不支持

二、安装与配置

2.1 安装 Restic

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# Ubuntu/Debian (使用官方仓库)
curl -LO https://github.com/restic/restic/releases/latest/download/restic_0.17.0_linux_amd64.bz2
bzip2 -d restic_0.17.0_linux_amd64.bz2
chmod +x restic_0.17.0_linux_amd64
sudo mv restic_0.17.0_linux_amd64 /usr/local/bin/restic

# 或使用包管理器
apt install restic  # 可能版本较旧

# CentOS/RHEL
yum install restic

# 验证安装
restic version

2.2 初始化仓库

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
# 本地仓库
export RESTIC_REPOSITORY=/backup/restic-repo
export RESTIC_PASSWORD_FILE=/etc/restic/password
restic init

# S3 兼容存储 (MinIO/AWS S3)
export RESTIC_REPOSITORY=s3:https://s3.example.com/backup-bucket
export AWS_ACCESS_KEY_ID=your-access-key
export AWS_SECRET_ACCESS_KEY=your-secret-key
export RESTIC_PASSWORD_FILE=/etc/restic/password
restic init

# SFTP 仓库
export RESTIC_REPOSITORY=sftp:user@backup-server:/backup/restic
export RESTIC_PASSWORD_FILE=/etc/restic/password
restic init

2.3 密码管理

1
2
3
4
5
6
7
8
# 创建密码文件
echo "your-secure-password" > /etc/restic/password
chmod 600 /etc/restic/password

# 或使用 GPG 加密密码
echo "your-password" | gpg -c > /etc/restic/password.gpg
# 使用时解密
export RESTIC_PASSWORD=$(gpg -d /etc/restic/password.gpg)

三、备份操作

3.1 基本备份

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# 备份单个目录
restic backup /home/user/data

# 备份多个目录
restic backup /etc /home/user/data /var/www

# 排除特定文件/目录
restic backup /home/user --exclude "*.log" --exclude "cache/"

# 使用排除文件
restic backup /home/user --exclude-file=/etc/restic/excludes.txt

# 添加标签便于识别
restic backup /home/user --tag "daily" --tag "web-server"

# 添加注释
restic backup /home/user --message "Daily backup before maintenance"

3.2 排除文件示例

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
# /etc/restic/excludes.txt
# 临时文件
*.tmp
*.temp
*~

# 缓存目录
cache/
.cache/
__pycache__/

# 日志文件
*.log
/var/log/

# 大型媒体文件 (可选)
*.iso
*.mp4
*.avi

3.3 备份脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
#!/bin/bash
# /usr/local/bin/restic-backup-daily.sh

set -e

# 配置
export RESTIC_REPOSITORY=/backup/restic-repo
export RESTIC_PASSWORD_FILE=/etc/restic/password
export RESTIC_COMPRESSION="auto"

# 日志
LOG_FILE="/var/log/restic/backup-$(date +%Y%m%d).log"
mkdir -p /var/log/restic

# 备份前钩子
echo "=== 备份开始：$(date) ===" | tee -a "$LOG_FILE"

# 执行备份
restic backup /etc /home /var/www \
    --exclude-file=/etc/restic/excludes.txt \
    --tag "daily" \
    --message "Automated daily backup" \
    2>&1 | tee -a "$LOG_FILE"

# 备份后钩子
echo "=== 备份完成：$(date) ===" | tee -a "$LOG_FILE"

# 检查备份结果
if [ ${PIPESTATUS[0]} -eq 0 ]; then
    echo "备份成功" | tee -a "$LOG_FILE"
else
    echo "备份失败!" | tee -a "$LOG_FILE"
    # 发送告警 (根据需要配置)
    # mail -s "Restic Backup Failed" admin@example.com < "$LOG_FILE"
    exit 1
fi

四、恢复操作

4.1 查看快照

1
2
3
4
5
6
7
8
9
10
11
# 列出所有快照
restic snapshots

# 按标签过滤
restic snapshots --tag "daily"

# 查看详细信息
restic snapshots --long

# 查看特定快照
restic snapshots --id abc123def

4.2 恢复数据

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# 恢复到原始位置 (会覆盖现有文件)
restic restore latest --target /

# 恢复到指定目录 (推荐)
restic restore latest --target /tmp/restore

# 恢复特定快照
restic restore abc123def --target /tmp/restore

# 恢复特定文件
restic restore latest --target /tmp/restore --include "/home/user/important.txt"

# 恢复特定目录
restic restore latest --target /tmp/restore --include "/home/user/documents/"

4.3 挂载快照

1
2
3
4
5
6
7
8
9
10
11
12
13
# 挂载仓库为文件系统
mkdir /mnt/restic
restic mount /mnt/restic

# 后台挂载
restic mount /mnt/restic &

# 访问快照
ls /mnt/restic/snapshots/
cp /mnt/restic/snapshots/latest/home/user/file.txt /tmp/

# 卸载
fusermount -u /mnt/restic

五、仓库维护

5.1 检查仓库完整性

1
2
3
4
5
6
7
8
# 快速检查
restic check

# 完整检查 (读取所有数据)
restic check --read-data

# 检查特定快照
restic check --read-data --verify-index

5.2 清理过期快照

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
# 删除过期快照 (根据保留策略)
restic forget --prune

# 预览将删除的内容 (不实际执行)
restic forget --prune --dry-run

# 保留策略示例
restic forget --prune \
    --keep-last 5 \
    --keep-daily 7 \
    --keep-weekly 4 \
    --keep-monthly 12 \
    --keep-yearly 5

# 按标签应用策略
restic forget --prune --tag "daily" --keep-daily 7
restic forget --prune --tag "weekly" --keep-weekly 4

5.3 仓库压缩

1
2
3
4
5
6
7
8
9
# 清理未引用的数据块
restic prune

# 完整重建仓库 (耗时较长)
restic rebuild-index

# 查看仓库统计
restic stats
restic stats --mode blobs-by-size

六、自动化备份方案

6.1 Systemd Timer 配置

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# /etc/systemd/system/restic-backup.service
[Unit]
Description=Restic Daily Backup
After=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/environment
ExecStart=/usr/local/bin/restic-backup-daily.sh
StandardOutput=journal
StandardError=journal

[Install]
WantedBy=multi-user.target
1
2
3
4
5
6
7
8
9
10
11
12
# /etc/systemd/system/restic-backup.timer
[Unit]
Description=Run Restic Backup Daily
Requires=restic-backup.service

[Timer]
OnCalendar=*-*-* 02:00:00
RandomizedDelaySec=300
Persistent=true

[Install]
WantedBy=timers.target
1
2
3
4
5
6
7
8
# 启用定时器
systemctl daemon-reload
systemctl enable restic-backup.timer
systemctl start restic-backup.timer

# 查看状态
systemctl list-timers
systemctl status restic-backup.timer

6.2 Cron 配置

1
2
3
4
5
6
7
8
9
# /etc/cron.d/restic-backup
# 每天凌晨 2 点执行
0 2 * * * root /usr/local/bin/restic-backup-daily.sh >> /var/log/restic/cron.log 2>&1

# 每周日执行完整检查
0 3 * * 0 root restic check --read-data >> /var/log/restic/check.log 2>&1

# 每月 1 号清理过期快照
0 4 1 * * root restic forget --prune --keep-last 5 --keep-daily 7 --keep-weekly 4 --keep-monthly 12 >> /var/log/restic/forget.log 2>&1

6.3 环境变量文件

1
2
3
4
5
6
# /etc/restic/environment
RESTIC_REPOSITORY=s3:https://s3.example.com/backup-bucket
AWS_ACCESS_KEY_ID=AKIAIOSFODNN7EXAMPLE
AWS_SECRET_ACCESS_KEY=wJalrXUtnFEMI/K7MDENG/bPxRfiCYEXAMPLEKEY
RESTIC_PASSWORD_FILE=/etc/restic/password
RESTIC_COMPRESSION=auto

七、多服务器备份架构

7.1 集中式备份服务器

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
# 备份服务器配置
# 创建专用用户
useradd -m -s /bin/bash restic
mkdir -p /backup/restic-repo
chown restic:restic /backup/restic-repo

# 配置 SSH 密钥认证
# 客户端生成密钥
ssh-keygen -t ed25519 -f /etc/restic/backup-key -N ""

# 服务端授权
cat /etc/restic/backup-key.pub >> /home/restic/.ssh/authorized_keys

# 限制 SSH 命令 (在 authorized_keys 前添加)
command="restic serve --repo /backup/restic-repo",no-port-forwarding,no-X11-forwarding,no-agent-forwarding ssh-ed25519 AAAA...

7.2 客户端配置

1
2
3
4
5
6
# 客户端使用 REST 服务器
export RESTIC_REPOSITORY=rest:http://backup-server:8000/
export RESTIC_PASSWORD_FILE=/etc/restic/password

# 或使用 SFTP
export RESTIC_REPOSITORY=sftp:restic@backup-server:/backup/restic-repo

7.3 Restic REST Server

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
# 安装 REST server
go install github.com/restic/rest-server@latest

# 运行服务
rest-server --path /backup/restic-repo --listen :8000 --append-only

# Systemd 服务
# /etc/systemd/system/rest-server.service
[Unit]
Description=Restic REST Server
After=network.target

[Service]
User=restic
Group=restic
ExecStart=/usr/local/bin/rest-server --path /backup/restic-repo --listen :8000 --append-only
Restart=always

[Install]
WantedBy=multi-user.target

八、监控与告警

8.1 备份状态检查脚本

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
#!/bin/bash
# /usr/local/bin/restic-check-status.sh

export RESTIC_REPOSITORY=/backup/restic-repo
export RESTIC_PASSWORD_FILE=/etc/restic/password

# 检查最新备份时间
LATEST=$(restic snapshots --json --latest | jq -r '.[0].time')
LATEST_EPOCH=$(date -d "$LATEST" +%s)
NOW_EPOCH=$(date +%s)
DIFF_HOURS=$(( (NOW_EPOCH - LATEST_EPOCH) / 3600 ))

if [ $DIFF_HOURS -gt 25 ]; then
    echo "CRITICAL: 备份已超过 ${DIFF_HOURS} 小时未更新"
    exit 2
elif [ $DIFF_HOURS -gt 12 ]; then
    echo "WARNING: 备份已超过 ${DIFF_HOURS} 小时未更新"
    exit 1
else
    echo "OK: 最新备份于 ${DIFF_HOURS} 小时前"
    exit 0
fi

8.2 Prometheus 导出器

1
2
3
4
5
6
7
8
9
10
11
12
13
14
# 使用 restic-prometheus-exporter
# https://github.com/gilbN/restic-prometheus-exporter

# 配置
cat > /etc/restic/exporter-config.yaml << EOF
restic:
  repository: /backup/restic-repo
  password_file: /etc/restic/password
server:
  address: ":9000"
EOF

# 运行
restic-prometheus-exporter --config /etc/restic/exporter-config.yaml

8.3 指标示例

1
2
3
4
5
6
7
8
9
10
11
# HELP restic_snapshot_count Number of snapshots in repository
# TYPE restic_snapshot_count gauge
restic_snapshot_count 156

# HELP restic_repository_size_bytes Total size of repository
# TYPE restic_repository_size_bytes gauge
restic_repository_size_bytes 52428800000

# HELP restic_last_backup_timestamp Timestamp of last backup
# TYPE restic_last_backup_timestamp gauge
restic_last_backup_timestamp 1710489600

九、故障排查

9.1 常见问题

问题 1：仓库锁死

1
2
3
4
5
# 查看锁
restic list locks

# 清除 stale 锁 (确保没有其他进程在使用)
restic unlock

问题 2：备份速度慢

1
2
3
4
5
6
7
8
9
# 检查网络带宽
# 检查磁盘 IO
iostat -x 1

# 调整并行度
export RESTIC_PARALLELISM=4

# 使用本地缓存
export RESTIC_CACHE_DIR=/var/cache/restic

问题 3：空间不足

1
2
3
4
5
6
7
8
# 查看仓库大小
restic stats

# 清理过期快照
restic forget --prune --keep-last 3

# 查看大文件
restic ls latest | sort -k3 -n -r | head -20

9.2 日志配置

1
2
3
4
5
6
# 启用详细日志
export RESTIC_VERBOSE=1
export RESTIC_JSON=1  # JSON 格式输出

# 记录到系统日志
restic backup /data 2>&1 | logger -t restic

十、最佳实践

10.1 3-2-1 备份原则

  • 3 份数据副本 (1 份生产 + 2 份备份)
  • 2 种不同存储介质
  • 1 份异地备份

10.2 保留策略建议

1
2
3
4
5
6
7
8
# 生产环境推荐
restic forget --prune \
    --keep-last 3 \
    --keep-daily 7 \
    --keep-weekly 4 \
    --keep-monthly 12 \
    --keep-yearly 3 \
    --tag "production"

10.3 安全建议

  1. 密码管理：使用强密码，定期更换
  2. 访问控制：限制仓库访问权限
  3. 加密传输：使用 TLS/SSH 传输数据
  4. 审计日志：记录所有备份和恢复操作
  5. 定期演练：定期测试恢复流程

10.4 性能优化

1
2
3
4
5
6
7
8
9
10
11
12
# 调整缓存
export RESTIC_CACHE_DIR=/var/cache/restic
export RESTIC_NO_CACHE=0

# 调整并行度
export RESTIC_PARALLELISM=$(nproc)

# 使用压缩 (如果后端支持)
export RESTIC_COMPRESSION="auto"

# 限制上传带宽
export RESTIC_LIMIT_UPLOAD=10000  # KB/s

十一、总结

Restic 是现代化的备份解决方案，具有安全、高效、易用的特点。部署要点：

  1. 选择合适的后端：根据数据量和预算选择存储
  2. 配置保留策略：平衡存储成本和恢复需求
  3. 自动化备份：使用 systemd timer 或 cron
  4. 监控告警：及时发现备份失败
  5. 定期演练：验证恢复流程有效性
  6. 异地备份：确保灾难恢复能力

备份的价值不在于备份本身，而在于能够成功恢复。定期测试恢复流程是备份策略中最重要的环节。