Back up servers with restic (and rclone)

restic is the right tool for Linux servers, databases and cPanel hosts: encrypted before upload, deduplicated, and incremental. rclone is the right tool for mirroring plain files. Both take the same values.

Verified: the commands below are exactly what our test suite runs against the live endpoint — init, backup, check, restore, forget and prune — every time we release.

1 · Create a key and a bucket

In your CloudBox dashboard → Backup: Create access key (copy the secret now) and Create bucket.

Setting	Value
Endpoint / server address	`https://s3.cloudbox.biz` (some tools want just `s3.cloudbox.biz`)
Region	`uk-1` — if the tool has no region field, leave it; the gateway accepts the default
Signature	Version 4 (V4)
Addressing	Path-style (`s3.cloudbox.biz/bucket/key`). Bucket-in-hostname addressing is not available yet.
Access key ID	`CBX…` from the Backup tab → Create access key
Secret access key	shown once when the key is created
Bucket	created in the Backup tab; lowercase letters, digits and hyphens, no dots
TLS	Yes — a normal public certificate, so leave certificate validation on

2 · restic

Install it (apt install restic on Ubuntu/Debian; a static binary for anything else), then set the environment. Keys belong in a file only root can read, not in shell history.

export AWS_ACCESS_KEY_ID="CBX...your key id..."
export AWS_SECRET_ACCESS_KEY="...your secret..."
export RESTIC_REPOSITORY="s3:https://s3.cloudbox.biz/my-bucket/restic"
export RESTIC_PASSWORD="a long passphrase you keep somewhere safe"

# once: create the repository (the folder inside your bucket)
restic init

# every backup: only changed data is uploaded, deduplicated against everything before it
restic backup /srv/data --exclude /srv/data/cache

# see what you have
restic snapshots

# restore the latest snapshot (or a snapshot id) to a directory
restic restore latest --target /tmp/restore

# keep 7 daily, 4 weekly, 6 monthly snapshots and free the space
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Every backup after the first uploads only changed blocks. restic check reads the repository structure; restic restore reads the data — both count toward the monthly download allowance.

On a schedule

# /etc/cron.d/restic-vault  (keys in /root/.restic-env, mode 600)
30 2 * * * root . /root/.restic-env && restic backup /srv/data /var/backups/db.sql.gz --quiet && restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune --quiet

TipOn a cPanel host, dump databases to a file first (mysqldump --all-databases | gzip > /var/backups/db.sql.gz) and back up /home and that file. That is the incremental alternative to cPanel's full S3 backups.

3 · rclone

Create ~/.config/rclone/rclone.conf (or run rclone config and choose S3 → Other):

[cloudbox]
type = s3
provider = Other
access_key_id = CBX...your key id...
secret_access_key = ...your secret...
endpoint = https://s3.cloudbox.biz
region = uk-1
force_path_style = true

rclone sync /srv/photos cloudbox:my-bucket/photos      # mirror a folder (deletes remote extras)
rclone copy /var/backups cloudbox:my-bucket/backups      # copy without deleting
rclone ls cloudbox:my-bucket                               # list
rclone check /srv/photos cloudbox:my-bucket/photos       # verify

Noterclone copies files as they are. For encrypted mirroring wrap the remote in an rclone crypt remote.

If something does not work

SignatureDoesNotMatch: the secret is wrong, or the server clock is off by more than a few minutes (install chrony or systemd-timesyncd).
NoSuchBucket: the bucket must be created in the dashboard first, and names are case-sensitive.
QuotaExceeded: the plan is full — restic forget --prune more aggressively, or move up a plan.
More in Errors & limits.

Questions

Do I need to set a region for restic?

No. restic signs with a default region and the gateway accepts it. If you prefer, add -o s3.region=uk-1. Path-style addressing is restic's default for a custom endpoint, which is what Vault supports.

Is a restic backup encrypted?

Yes, always. restic encrypts every block with your repository password before upload, so the backup is zero-knowledge. Losing the password loses the backup — keep it somewhere other than the server.

How much does restic upload each run?

Only blocks that changed, deduplicated against everything already in the repository. A daily backup of a 500 GB server typically uploads a few GB. This is the incremental alternative to cPanel's full S3 backups.

Can I use rclone instead?

Yes, for plain file mirroring. rclone copies files as they are (no encryption unless you add an rclone crypt remote) and is ideal for photos, exports and archives. Use provider Other, path-style, and the endpoint above.

Can restic and rclone share a bucket?

Yes, in different folders (prefixes). Keep restic's folder for restic only; it manages the files inside it.