Backrest restic Backup Manager on AWS User Guide

Overview

Backrest is a popular open source web interface and orchestrator for restic, the fast, secure, deduplicating backup program. From an ordinary browser it lets you configure backup repositories, define backup plans and schedules, set retention and forget policies, run integrity checks, and browse or restore any snapshot, all without touching the restic command line. Every operation Backrest runs is a real restic command, so your backups stay in the open, well documented restic repository format and can be read or restored with restic directly at any time.

The cloudimg image serves Backrest 1.14.1 behind an nginx reverse proxy on a hardened, fully patched Ubuntu 24.04 LTS base, with the matching restic 0.19.1 binary already installed so the appliance is ready offline. Backrest is a single self contained Go binary that embeds its own web UI and an embedded SQLite operation log. The server listens only on the loopback interface (127.0.0.1:9898) and nginx serves it on port 80. A unique administrator password is generated on the first boot of every instance and written to a root only file, so no shared or default login ever ships in the image. Backed by 24/7 cloudimg support.

What is included:

• Backrest 1.14.1 served behind nginx, managed by systemd
• restic 0.19.1 preinstalled at /usr/local/bin/restic (the version Backrest expects), so the appliance needs no download on first use
• The Backrest web interface on :80 with a per instance administrator login required
• A per instance administrator password generated on first boot and recorded in a root only file
• A fresh per instance authentication signing key generated on first boot, so sessions cannot be forged across deployments
• The Backrest server bound to 127.0.0.1:9898 only, never exposed directly to the network
• A dedicated EBS data volume at /var/lib/backrest for the configuration, the operation log and any local restic repositories
• backrest.service and nginx.service as enabled systemd units
• 24/7 cloudimg support

Backrest is licensed under the GNU General Public License v3.0. This image bundles the unmodified upstream Backrest and restic binaries and is not affiliated with or endorsed by the Backrest or restic projects.

Prerequisites

An active AWS account, an EC2 key pair in the target region, and a VPC with a subnet. m5.large (2 vCPU / 8 GiB RAM) is a sensible starting point; size up for heavier backup workloads or larger local repositories. Security group inbound: allow 22/tcp from your management network and 80/tcp for the web interface. Backrest serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The Backrest server is never exposed directly: it listens on 127.0.0.1:9898 only, so port 9898 stays off the network.

Step 1 - Launch from the AWS Marketplace

In the AWS Marketplace search for Backrest by cloudimg, choose Continue to Subscribe, accept the terms, then Continue to Configuration and Continue to Launch. Pick your region, the recommended m5.large instance type, your VPC and subnet, and a security group that allows SSH (22) and HTTP (80). Select your EC2 key pair and launch. The dedicated EBS data volume is attached automatically from the AMI.

Step 2 - Launch with the AWS CLI

aws ec2 run-instances \
  --image-id <backrest-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <sg-with-22-and-80> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=backrest}]'

Find the AMI id for your region on the product's Launch page in the Marketplace console, or with aws ec2 describe-images filtered by the product's AMI name.

Connecting to your instance

Connect over SSH as the default login user for your operating system variant, using the private key for the EC2 key pair you launched with:

ssh -i <your-key.pem> ubuntu@<instance-public-ip>

Step 3 - Confirm the services are running

SSH in and confirm Backrest and nginx are active. Note that the Backrest server listens only on 127.0.0.1:9898 while nginx serves the web interface on port 80.

systemctl is-active backrest nginx backrest-firstboot

ss -tlnp 2>/dev/null | grep -E ':80 |:9898 ' | awk '{print $1, $4}'

Step 4 - Retrieve the per instance administrator password

Every instance generates its own administrator password on first boot and writes it, along with the login user and URL, to a root only credentials file. Read it with sudo:

sudo cat /root/backrest-credentials.txt

You sign in to Backrest with username admin and the backrest.admin.pass value from this file. You can prove the login works from the command line by requesting an authentication token with those credentials:

PASS=$(sudo grep '^backrest.admin.pass=' /root/backrest-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w 'login HTTP %{http_code}\n' -m 20 -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" http://127.0.0.1/v1.Authentication/Login

Step 5 - Sign in to Backrest

Browse to http://<instance-public-ip>/. Backrest opens on its sign in screen. Enter username admin and the password from Step 4.

Step 6 - The getting started dashboard

Once signed in you land on the getting started view, with the sidebar giving quick access to Plans, Repositories and Settings. Repositories map directly to restic repositories, and plans configure what to back up and on what schedule.

Step 7 - Add a backup repository

A repository is where restic stores your encrypted, deduplicated snapshots. Click Add Repo in the sidebar to open the repository form. Give the repository a name, set its location under Connection (a local path such as /var/lib/backrest/repos/main on the data volume, or a remote such as S3, Backblaze B2, SFTP or any restic supported backend), and set an encryption password. Use Test Configuration to validate access before saving.

Local repositories live on the dedicated EBS data volume under /var/lib/backrest/repos, so they are captured with the volume and kept separate from the operating system disk.

Step 8 - Create a backup plan

A plan tells Backrest what to back up, where, and on what schedule. Click Add Plan, give it a name, select the repository from Step 7, add one or more paths to include under Scope, then set a Schedule (for example an hourly or daily cron) and a Retention policy to prune old snapshots automatically. Each time a plan runs it creates a snapshot in its repository, which you can browse by date and restore individual files or whole directories from, all from the web UI.

Step 9 - Manage users and authentication

Open Settings from the sidebar to manage the instance identity, users and authentication. The image ships with the single per instance admin user created on first boot; add further users, change the password, or configure multihost identity from here. Leave Disable Authentication off so a login is always required.

Step 10 - Verify the stack

Confirm the Backrest and restic versions, that the services are enabled, and that authentication is enforced end to end through nginx:

/usr/local/bin/backrest --version 2>&1 | grep -i version | head -1

/usr/local/bin/restic version | head -1

systemctl is-enabled backrest nginx

PASS=$(sudo grep '^backrest.admin.pass=' /root/backrest-credentials.txt | cut -d= -f2-); U=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d '{}' http://127.0.0.1/v1.Backrest/GetConfig); TOK=$(curl -s -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" http://127.0.0.1/v1.Authentication/Login | sed -n 's/.*"token":"\([^"]*\)".*/\1/p'); A=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d '{}' http://127.0.0.1/v1.Backrest/GetConfig); echo "no token: $U   with token: $A"

The unauthenticated request returns 401 and the request with the token returns 200, proving authentication is enforced on the API:

no token: 401   with token: 200

Step 11 - Where your data lives

The Backrest configuration, its operation log and any local restic repositories live on a dedicated EBS data volume mounted at /var/lib/backrest, separate from the OS disk. This volume is captured into the AMI and re provisioned on every instance. Confirm the mount and the filesystem:

df -h /var/lib/backrest | tail -1

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/backrest

Security notes

• Backrest serves plain HTTP on port 80. For production, put it behind your own TLS terminating reverse proxy, an Application Load Balancer with an ACM certificate, or CloudFront for your domain, and restrict port 80 in the security group to trusted networks.
• The Backrest server listens on 127.0.0.1:9898 only and is never exposed directly; only nginx on port 80 faces the network.
• Authentication is required on the API. The per instance administrator password lives in /root/backrest-credentials.txt, readable only by root. Sign in and add or change users from Settings if you wish, and keep a copy somewhere safe.
• Choose a strong, unique encryption password for every repository. restic encrypts all data at rest with it, and losing it means the backups cannot be recovered.
• Keep the instance patched. The image ships fully patched with unattended security upgrades enabled.

Support

cloudimg images come with 24/7 support. If you have any questions about this Backrest image or need help with your deployment, contact us through the cloudimg website.