After a year of development, the release of the restic 0.13 backup system has been announced, which provides tools for saving backups in a versioned repository that can be hosted on external servers and in cloud storage. Data is stored in encrypted form. Flexible rules can be defined for including and excluding files and directories when creating a backup. It supports operation in Linux, macOS, Windows, FreeBSD, and OpenBSD. The project's code is written in Go and distributed under the BSD license.
Main Features:
- Support for storing backups on local file systems, on external server with access via SFTP/SSH or HTTP REST, in cloud services such as Amazon S3, OpenStack Swift, BackBlaze B2, Microsoft Azure Blob Storage, and Google Cloud Storage, as well as in any storage systems for which rclone backends are available. A special rest server can also be used to organize storage, providing higher performance compared to other backends and capable of operating in a supplement-only mode, which prevents the deletion or alteration of backups in case the original is compromised server and access to encryption keys.
- Support for defining flexible rules for excluding files and directories when creating backups (for example, to exclude logs, temporary files, and easily reproducible data from the backup). The ignore rule format is familiar and resembles rsync or gitignore.
- Ease of installation, use, and information recovery. To work with backups, it is sufficient to copy a single executable file that can be used without additional configuration. The executable file is provided with a reproducible build, allowing users to verify that the binary build is generated from the provided source texts.
- Snapshots are supported, reflecting the state of a specific directory with all files and subdirectories at a given moment in time. With each new backup, an associated snapshot is created, allowing restoration of that state at that moment. Snapshots can be copied between different repositories.
- To save bandwidth, only changed data is copied during the backup process. To ensure efficient storage, data in the repository is not duplicated, and additional snapshots only cover changed data. The system operates not on whole files but on variable-size chunks, chosen using Rabin fingerprinting. Information is stored in relation to content rather than file names (associated names and objects are determined at the metadata level of the block). Deduplication and exclusion of redundant data are performed based on the SHA-256 hash of the content.
- To provide a clear assessment of the repository content and simplify recovery, a snapshot with a backup can be mounted as a virtual partition (mounting is done using FUSE). Commands are also provided for analyzing changes and selectively extracting files.
- Information on external servers is stored in an encrypted format (SHA-256 is used for checksums, AES-256-CTR for encryption, and authentication codes based on Poly1305-AES are used to ensure integrity). The system is originally designed with the assumption that backups are stored in untrusted environments, and access to a backup by unauthorized parties should not compromise the system. Encryption can be provided either by access keys or by passwords.
- Verification of backups using checksums and authentication codes is available to confirm that file integrity has not been compromised and that necessary files can be restored without hidden modifications.
In the new version:
- Support for negative exclusion patterns has been added. For example, "--exclude '/home/user/*' --exclude '!/home/user/.config'" to exclude all contents of /home/user except the /home/user/.config directory.
- The 'backup' command now includes a '--dry-run' mode, which, when run with the '--verbose' option, allows tracking which files would be included in the backup without making any actual changes.
- Support for checksums has been added to various storage backends for additional validation of uploaded data.
- The 'restore' command has been optimized, making it work twice as fast. Performance improvements have also been made to the 'copy' command.
Source: opennet.ru
