rest-server v0.1.0

Backup

Restic REST Server — a high-performance HTTP backend for restic backups, faster than restic's SFTP/S3 backends and able to run append-only so clients can't delete history. Deployed as a single host-networked Nomad service with a data volume for repositories. Pairs with the backup pack as its restic target.

nomad-pack run rest-server --registry nomploy

Source ↗ Project ↗ ★ 1.5k

1 task http 8000 1 volume image restic/rest-server:latest

Variables 11

values.hcl

Save as values.hcl, edit, then run:

nomad-pack run rest-server -f values.hcl --registry nomploy

# The name of the Nomad job.
job_name = "rest-server"

# The Nomad namespace to deploy into.
namespace = "default"

# The datacenters to deploy to.
datacenters = ["*"]

# The restic REST server image. Pin a tag in production.
image = "restic/rest-server:latest"

# Host port for the REST API (restic repository endpoint).
port = 8000

# Named volume for restic repositories and the .htpasswd file (/data).
data_volume = "rest_server_data"

# Disable HTTP basic auth (no .htpasswd needed). Fine on a trusted internal network; keep it false and create users for anything reachable.
disable_auth = true

# Run append-only: clients can create and read snapshots but cannot delete them (ransomware-resistant). Prune from the server side instead.
append_only = true

# Extra flags appended to the server OPTIONS (e.g. "--private-repos", "--prometheus").
extra_options = ""

# Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
constraints = []

# The task resources.
resources = {
    cpu    = 300
    memory = 128
  }

Name	Type	Default	Description
job_name	string	"rest-server"	The name of the Nomad job.
namespace	string	"default"	The Nomad namespace to deploy into.
datacenters	list	["*"]	The datacenters to deploy to.
image	string	"restic/rest-server:latest"	The restic REST server image. Pin a tag in production.
port	number	8000	Host port for the REST API (restic repository endpoint).
data_volume	string	"rest_server_data"	Named volume for restic repositories and the .htpasswd file (/data).
disable_auth	bool	true	Disable HTTP basic auth (no .htpasswd needed). Fine on a trusted internal network; keep it false and create users for anything reachable.
append_only	bool	true	Run append-only: clients can create and read snapshots but cannot delete them (ransomware-resistant). Prune from the server side instead.
extra_options	string	""	Extra flags appended to the server OPTIONS (e.g. "--private-repos", "--prometheus").
constraints	list	[]	Placement constraints. Pin to the node holding the volume. On a nomploy cluster: attribute = "$${meta.nomploy_control_plane}", operator = "=", value = "true".
resources	object	{ cpu = 300 memory = 128 }	The task resources.

Readme

rest-server

Restic REST Server — a high-performance HTTP backend for restic backups. Faster than the SFTP/S3 backends, and its append-only mode means a compromised client can create and read snapshots but never delete them.

Single host-networked Nomad service with a data volume for repositories. Pairs with the backup pack as its restic target (an alternative to the S3/SeaweedFS route).

Deploy

nomad-pack registry add nomploy https://github.com/Nomploy/nomad-packs
nomad-pack run rest-server --registry=nomploy

Configure

Variable	Default	Description
`port`	`8000`	REST API / repository endpoint.
`data_volume`	`rest_server_data`	`/data` — repositories + `.htpasswd`.
`disable_auth`	`true`	Disable HTTP basic auth (trusted network). Set `false` and create users otherwise.
`append_only`	`true`	Clients can't delete snapshots; prune server-side.
`extra_options`	`""`	Extra server flags, e.g. `--private-repos`, `--prometheus`.
`image`	`restic/rest-server:latest`	Container image. Pin a tag in production.
`resources`	`{ cpu = 300, memory = 128 }`	Task resources.

Use from restic

export RESTIC_REPOSITORY="rest:http://<node-ip>:8000/myrepo"
export RESTIC_PASSWORD="..."
restic init && restic backup /path

With disable_auth = false, create users (writes .htpasswd on the volume):

nomad alloc exec -task rest-server <alloc> create_user <username>

then use rest:http://<user>:<pass>@<node-ip>:8000/. Auth-off should stay on a trusted network or behind TLS + auth. Pin the job to the node holding data_volume with constraints.