Setup Backup Otomatis Server Linux dengan Restic

Aturan 3-2-1#

Untuk data production:

• 3 copies (production + 2 backup)
• 2 media berbeda (disk + cloud storage)
• 1 offsite (di luar data center yang sama)

Tools yang kami pakai untuk klien hosting: Restic (open source) + cloud storage object (S3-compatible).

Kenapa Restic, bukan rsync atau tar#

• Encrypted by default — repository pakai AES-256, password-protected. Aman ditaruh di public S3 bucket sekalipun.
• Deduplicated — block-level dedup. Backup harian incremental cuma store delta. 30 backup harian bisa hemat 90%+ ruang.
• Cross-platform — backup dari Linux server, restore di laptop dev kalau perlu.
• Mountable snapshot — restic mount mount snapshot lama sebagai filesystem read-only. Cari file yang terhapus 2 minggu lalu? Tinggal cd /mnt/restic/snapshots/2025-09-15/.

Setup standar (yang kami pakai)#

# Init repository ke Cloudflare R2 (S3-compatible)
export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
export RESTIC_REPOSITORY="s3:https://r2.lancartech.dev/backups/myapp"
export RESTIC_PASSWORD_FILE="/root/.restic-pass"

restic init

# Backup script
restic backup /var/www /etc /opt/myapp \
  --exclude '*.log' \
  --exclude 'node_modules' \
  --tag daily

# Retention policy
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

Cron daily 02:00 + lock file untuk prevent overlap.

Yang sering terlewat#

1. Test restore secara berkala — backup tanpa test restore = bukan backup. Sebulan sekali kami spin VM kosong dan restore full snapshot ke sana.
2. Database dump dulu, baru backup — kalau backup mysqldata directly tanpa stop daemon, snapshot bisa corrupt. Pakai mysqldump atau pg_dump untuk consistent dump.
3. Monitor backup success — jangan asumsi cron jalan. Pakai healthcheck endpoint (Healthchecks.io / cron-monitoring) yang ngirim WhatsApp alert kalau gagal.

Konsultasi disaster recovery kalau Anda lagi pikir-pikir strategi backup.