sq.

Back up a file and prove you can restore it

Create an encrypted restic repository and compare a restored file with its source.

Published:

Run this in the practice project after creating its password file. The job mounts only the sample site, backup volume, password, and restore directory. It has no network access. These commands back up a static file, not a database.

sudo docker compose run --rm backup init
sudo docker compose run --rm backup backup /source
sudo docker compose run --rm backup snapshots
sudo docker compose run --rm backup check
sudo docker compose run --rm backup restore latest --target /restore --verify
cmp apps/custom-apps/site/index.html restore/source/index.html

init creates a new encrypted repository. Run it once. If it says the repository exists, use snapshots with its original password instead. backup creates a snapshot, a record of files at that time. check validates repository structures; it does not read every stored data block unless you request the appropriate data-reading option. restore --verify checks the restored files. An empty cmp response and exit status 0 confirm that the sample HTML matches.

The restore destination is separate from the original site. Open restore/source/index.html and read it. Never make the first recovery attempt overwrite your only working copy. If permissions prevent reading the password or writing recovery files, check the specific mounted paths and the backup capability exception explained in Compose settings. Do not make secrets world-readable.

What this exercise does not protect against

The backup volume is on the same machine. Losing that machine can destroy both copies. A real plan needs an independent destination, retained older snapshots, protected credentials, monitoring, and periodic recovery on a separate machine. Encryption cannot help if you lose the repository password.

For a database application, back up its supported database export, uploaded files, configuration, and necessary encryption keys as a consistent set. A healthy container or a successful file copy does not prove a database can be restored. Follow that application's version-specific restoration instructions.

Record backup time, snapshot identifier, restore destination, comparison result, and any missing files in a private recovery log. Do not publish repository URLs or credentials. Restic restoration documentation

Next: add one stack.

All notes →