Cloud backups — Windows, Mac, Linux, 1C and databases

A copy on the same server, or on a disk in the next room, dies together with the original: ransomware, fire and theft don’t pick and choose. A backup has to live somewhere else — and run by itself, without a person.

The answer is restic on a schedule: it encrypts data on your side, uploads only what changed and keeps it in a bucket in our S3 storage.

The setup is the same for a server and a workstation, on Windows, Mac and Linux. The only difference is how open files and databases get copied: a shadow copy on Windows, closing the program for 1C, a dump for databases.

What you get: a daily encrypted backup of the folders and databases you pick, stored in the cloud, with history for the period you choose. Only a test restore shows whether the backups are usable — it’s at the end of this guide. You’ll need: administrator rights on the computer or server and S3 storage enabled. Time: about an hour, including a test restore.

1. Create a bucket and turn on deletion protection

Control panel → S3 storage → Create bucket: private, region ru-1 or eu-1. The name gets your account prefix — for example, u42-backups. Access keys are on the same card.

Right away, before the first backup, set Deletion protection: 30 days on the bucket. restic keeps its keys on the server, and they work for every bucket in the account: an intruder or ransomware that takes the server can delete the backups with them too. With protection on:

• the storage doesn’t delete files for good for 30 days: a delete request, whatever key it comes with, only hides the file, and the data stays;
• the storage extends the lock of files restic hasn’t deleted by itself, every half term;
• whatever restic discards during cleanup is kept for 30 more days and then removed.

Nothing changes on the restic side. Plain versioning is no substitute: the same key deletes old versions as well.

What it costs: whatever restic discards is kept and billed for about a month on top of the live size — that’s why the scripts below clean up the repository weekly rather than nightly.

Before your first payment a bucket is capped at 10 GB, and a full bucket stops accepting writes — the nightly backup simply won’t be saved. Estimate the size in advance.

2. Install restic and create a repository

Windows: download restic_…_windows_amd64.zip from the releases page and put restic.exe into C:\restic\. You need version 0.16 or later — that’s where shadow copies arrived.

Mac: brew install restic.

Linux: apt install restic or dnf install restic. If your distribution ships a version older than 0.17, take the binary from the releases page.

Save the repository password to a file (C:\restic\password.txt or /root/.restic-password, readable by administrators only) and to one more safe place off the server — for example, your personal password manager. A failed disk or a compromised server takes the password file down with it, and without the password the backups can’t be decrypted — we can’t recover it for you.

Create the repository. Windows, PowerShell as administrator:

# Fill in your own: bucket name and keys are on the storage card in the control panel
$bucket = "YOUR_BUCKET_NAME"   # for example, u42-backups
$folder = "office-server"      # a folder for this computer
$env:AWS_ACCESS_KEY_ID     = "YOUR_ACCESS_KEY"
$env:AWS_SECRET_ACCESS_KEY = "YOUR_SECRET_KEY"
# Nothing to change below
$env:RESTIC_REPOSITORY     = "s3:https://s3.webshield.pro/$bucket/$folder"
$env:RESTIC_PASSWORD_FILE  = "C:\restic\password.txt"
C:\restic\restic.exe init

These are restic’s own variables — there’s nothing to look for in the control panel. AWS_… are the access keys, RESTIC_REPOSITORY is the repository address: our storage, your bucket and a folder in it. One bucket can hold any number of folders — one per computer. No region is needed: it’s set on the bucket when it’s created. On Mac and Linux it’s the same with export.

Check: restic snapshots returns an empty list with no errors.

3. Turn on shadow copies

A file that a program keeps open changes while it is being copied, and the backup ends up with a mix of old and new pieces. That’s especially dangerous for databases: 1C, mailboxes, SQL databases. On Windows restic can copy from a volume shadow copy (VSS): an instant snapshot of the disk that stays frozen while the backup runs. The --use-fs-snapshot flag turns it on, and it only works as administrator.

C:\restic\restic.exe backup --use-fs-snapshot D:\Bases D:\Documents

With a shadow copy, open files make it into the backup too — including a 1C file database that people are working in at that very moment. But the snapshot freezes the disk at a random instant, as if the power went out: an operation 1C hadn’t finished stays unfinished in the copy. Such a database may open straight away, or it may need 1C’s test-and-repair — and you’ll find out on the day you need the backup. That’s why it’s better to close 1C first.

On Mac and Linux restic doesn’t take shadow copies. Copy files as they are and databases as dumps (step 5).

4. Close 1C before the backup

The C:\restic\backup.ps1 script first asks 1C to close, forces whatever is left after a minute and backs up from a shadow snapshot; on Sundays it also thins out old backups:

$bucket = "YOUR_BUCKET_NAME"   # as in step 2
$folder = "office-server"
$env:AWS_ACCESS_KEY_ID     = "YOUR_ACCESS_KEY"
$env:AWS_SECRET_ACCESS_KEY = "YOUR_SECRET_KEY"
$env:RESTIC_REPOSITORY     = "s3:https://s3.webshield.pro/$bucket/$folder"
$env:RESTIC_PASSWORD_FILE  = "C:\restic\password.txt"
$restic = "C:\restic\restic.exe"
$log    = "C:\restic\backup.log"

# Close 1C for every user: politely first, by force a minute later
Get-Process 1cv8, 1cv8c -ErrorAction SilentlyContinue | ForEach-Object { $_.CloseMainWindow() | Out-Null }
Start-Sleep -Seconds 60
Get-Process 1cv8, 1cv8c -ErrorAction SilentlyContinue | Stop-Process -Force

& $restic backup --use-fs-snapshot D:\Bases D:\Documents *>> $log
if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }

# On Sundays — cleanup: keep 14 daily, 8 weekly and 12 monthly backups
if ((Get-Date).DayOfWeek -eq "Sunday") {
    & $restic forget --keep-daily 14 --keep-weekly 8 --keep-monthly 12 --prune *>> $log
}

A forced close loses any unsaved document, so run the script at night and warn your colleagues. If 1C runs on several computers with the database in a shared folder, the script only closes sessions running on this server — other users have to sign out themselves, or the close step has to run on their machines too.

This is for a file database. A client-server 1C keeps its data in MS SQL or PostgreSQL: back up a dump, not the DBMS files. Make it with the DBMS’s own tools into a folder restic picks up — BACKUP DATABASE in MS SQL or pg_dump in PostgreSQL — and run it before restic backup.

Put the script on a schedule: Task Scheduler → Create Task, account SYSTEM, Run with highest privileges checked, trigger — daily at 03:00, action — powershell.exe -ExecutionPolicy Bypass -File C:\restic\backup.ps1.

Check: run the task by hand. backup.log has a snapshot … saved line and restic snapshots lists the new backup.

5. Mac and Linux: files and database dumps

On Mac and Linux it’s the same scheme — a script and cron. Dump databases straight into the repository, without an intermediate file (restic 0.17 or later):

#!/bin/sh
# /root/backup.sh — site files and a PostgreSQL dump
set -e
BUCKET=YOUR_BUCKET_NAME   # for example, u42-backups
export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
export RESTIC_REPOSITORY=s3:https://s3.webshield.pro/$BUCKET/web-server
export RESTIC_PASSWORD_FILE=/root/.restic-password

restic backup /var/www /etc
restic backup --stdin-filename shop.sql --stdin-from-command -- sudo -u postgres pg_dump shop
# On Sundays — clean up old backups
if [ "$(date +%u)" = 7 ]; then
  restic forget --keep-daily 14 --keep-weekly 8 --keep-monthly 12 --prune
fi

For MySQL use mysqldump --single-transaction shop instead of pg_dump. In cron: 0 3 * * * /root/backup.sh >> /var/log/restic.log 2>&1.

On a Mac, back up your home folders instead of /var/www /etc — for example, ~/Documents ~/Desktop. macOS keeps background jobs out of personal folders: add /usr/sbin/cron under System Settings → Privacy & Security → Full Disk Access, otherwise the backup comes out empty and the log says operation not permitted. The laptop has to be awake at run time — cron won’t retry a missed night.

Verify

A backup you have never restored from is a hope, not a backup. Once a month:

restic snapshots
restic restore latest --target D:\restore-test --include D:\Bases
restic check --read-data-subset=5%

Open the restored 1C database in a separate platform copy and make sure it starts and the latest documents are there. restic check with a subset reads part of the data back from the cloud and verifies checksums.

If the server was hacked

Reissue the keys in the control panel — the old ones stop working within a minute. Then click Restore deleted on the bucket and pick a time shortly before the attack: the storage undeletes files deleted after that moment, as long as their protection term hasn’t run out. Whatever restic itself discarded earlier stays discarded. Then, on another computer with the new keys, check the repository: restic check --read-data — only that shows whether it’s intact.

Troubleshooting

Symptom	Likely cause and fix
Access Denied or SignatureDoesNotMatch	The keys were copied with a space or have been reissued. Take the current pair from the storage card.
The specified bucket does not exist	The account prefix is missing: you need u42-backups, not backups.
--use-fs-snapshot fails with a VSS error	The script isn’t running as administrator, or the Volume Shadow Copy service is disabled. In Task Scheduler use SYSTEM and highest privileges.
Backups worked, then started failing on write	The bucket is full: before your first payment it’s capped at 10 GB. Top up your balance or back up fewer folders.
The 1C backup opens with errors	Most likely a running database was copied. Make sure the script really closes 1C on every machine, and for a client-server database back up the DBMS dump.
operation not permitted on a Mac	cron lacks Full Disk Access — see step 5.
repository is already locked	A previous run was cut short. Make sure restic isn’t running anywhere else and run restic unlock.

What’s next

• Object storage (S3) — versioning, Object Lock, limits and billing.
• rclone — if you want a mirror of a folder rather than backup history.