Skip to content

Backups

Jump to bottom
Angelo Azevedo edited this page Jun 22, 2026 · 1 revision

Automated Backup Infrastructure

The system employs a fully automated, deduplicated backup strategy using Restic backed by Rclone. This allows secure, encrypted backups to be seamlessly sent to multiple remote destinations (like Google Drive and NAS) via Systemd timers.

Architecture

  • Restic: Handles file hashing, deduplication, snapshotting, and End-to-End Encryption.
  • Rclone: Acts as the backend transport layer, allowing Restic to securely communicate with SMB shares and Google Drive APIs.
  • Systemd Timers: Backups are configured to trigger daily with randomized delays to avoid network spikes.

Repositories

The system currently backs up the /home and /persist directories to three destinations:

  1. NAS (Local): An SMB share located at homes/ang3lo/backups.
  2. Google Drive: The primary cloud backup located at /backups.
  3. Google Shared Drive: A secondary cloud backup.

Security & Secrets

All credentials are fully encrypted at rest using agenix.

  • user_password: Used by Restic to encrypt and decrypt the repository.
  • rclone-conf: Used by Rclone to authenticate with the remote backends (contains the SMB credentials and Google Drive OAuth tokens).

Note

The rclone-conf is assigned to userSecretConfig, granting the standard user read access. This is necessary so GUI applications (like Restic Browser) can utilize the Rclone configurations without requiring root privileges.

Rate Limiting Optimizations

Google Drive is notorious for aggressively throttling API requests. To prevent crashes during massive initial backups, the system applies the following systemd environment variable limits to the Google Drive services:

  • RCLONE_TPSLIMIT=3
  • RCLONE_TPSLIMIT_BURST=3
  • RCLONE_DRIVE_CHUNK_SIZE=64M

Manual Control via Shell Aliases

You can manually trigger and monitor backups using custom zsh aliases. Because initial backups can take a long time, the aliases start the tasks in the background (--no-block) and automatically attach journalctl -f so you can watch live logs.

  • backup-all: Starts NAS, GDrive, and Shared Drive backups simultaneously.
  • backup-nas: Starts the NAS backup.
  • backup-gdrive: Starts the Google Drive backup.
  • backup-shared: Starts the Google Shared Drive backup.

Tip

The backup-all command uses journalctl --output=with-unit to prefix each log line with its specific backup service, making it easy to differentiate the interwoven logs.

GUI Access

To graphically browse snapshots, view files, and easily download/restore files, Restic Browser is installed via Home Manager.

Custom aliases have been created to instantly launch the GUI pre-configured for each repository:

  • browse-nas
  • browse-gdrive
  • browse-shared

Simply run the alias, type your user password, and you will instantly connect to the repository.

Future Enhancements

  • Crypt Mount: There is an active TODO to implement a systemd user service that automatically mounts an Rclone Crypt remote over Google Drive. This will provide a seamless, Zero-Knowledge End-to-End encrypted local folder for highly sensitive documents.

Clone this wiki locally