Backrest

Prerequisites

You need an active Azure subscription, an SSH key pair, and a VNet with a subnet in the target region.

Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting size. Choose a larger size for heavier backup workloads or larger local repositories.

Configure the network security group (NSG) to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Backrest serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain. The Backrest server is never exposed directly. It listens on 127.0.0.1:9898 only, so port 9898 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Backrest by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name backrest \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name backrest --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Backrest and nginx are active. The Backrest server listens only on 127.0.0.1:9898, while nginx serves the web interface on port 80.

systemctl is-active backrest nginx backrest-firstboot

ss -tlnp | grep -E ':80 |:9898 ' | awk '{print $1, $4}'

Step 4 - Retrieve the per-VM administrator password

Every VM generates its own administrator password on first boot. It writes the password, along with the login user and URL, to a root-only credentials file. Read it with sudo:

sudo cat /root/backrest-credentials.txt

Sign in to Backrest with username admin and the backrest.admin.pass value from this file. To confirm the login works from the command line, request an authentication token with those credentials:

PASS=$(sudo grep '^backrest.admin.pass=' /root/backrest-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w 'login HTTP %{http_code}\n' -m 20 -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" http://127.0.0.1/v1.Authentication/Login

Step 5 - Sign in to Backrest

Browse to http://<vm-public-ip>/. Backrest opens on its sign-in screen. Enter username admin and the password from Step 4.

After you sign in, you land on the summary dashboard. It shows the health of every plan at a glance: when each plan last backed up, how much data is protected, and a recent activity feed.

Step 6 - Add a backup repository

A repository is where restic stores your encrypted, deduplicated snapshots. Click Add Repo in the sidebar to open the repository form.

Give the repository a name. Under Connection, set its location: either a local path such as /var/lib/backrest/repos/main on the data disk, or a remote such as S3, Backblaze B2, SFTP or any restic-supported backend. Then set an encryption password. Use Test Configuration to validate access before saving.

Local repositories live on the dedicated data disk under /var/lib/backrest/repos. They are captured with the disk and kept separate from the operating system disk.

Step 7 - Create a backup plan

A plan tells Backrest what to back up, where, and on what schedule. Click Add Plan and give it a name. Select the repository from Step 6, and add one or more paths to include under Scope.

Then set a Schedule (for example an hourly or daily cron) and a Retention policy to prune old snapshots automatically.

Step 8 - Browse and restore snapshots

Each time a plan runs, it creates a snapshot in its repository. Open the plan from the sidebar to see its backup history as a browsable tree by date.

From any snapshot, you can inspect the files it captured and restore individual files or whole directories. You can also run restic operations such as check, prune and forget, all from the web UI.

Step 9 - Verify the stack

Confirm the Backrest and restic versions, confirm that the services are enabled, and check that authentication is enforced end to end through nginx:

/usr/local/bin/backrest --version | grep -i version:

/usr/local/bin/restic version | head -1

systemctl is-enabled backrest nginx

PASS=$(sudo grep '^backrest.admin.pass=' /root/backrest-credentials.txt | cut -d= -f2-);
U=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d '{}' http://127.0.0.1/v1.Backrest/GetConfig);
TOK=$(curl -s -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" http://127.0.0.1/v1.Authentication/Login | sed -n 's/.*"token":"\([^"]*\)".*/\1/p');
A=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d '{}' http://127.0.0.1/v1.Backrest/GetConfig); echo "no token: $U with token: $A"

The unauthenticated request returns 401, and the request with the token returns 200. This proves that authentication is enforced on the API:

no token: 401 with token: 200

Step 10 - Where your data lives

The Backrest configuration, its operation log and any local restic repositories live on a dedicated Azure data disk mounted at /var/lib/backrest, separate from the OS disk. The image captures this disk and re-provisions it on every VM. Confirm the mount and the filesystem:

df -h /var/lib/backrest | tail -1

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/backrest

Security notes

• Encrypt web traffic. Backrest serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy or an Azure Application Gateway with a certificate for your domain, and restrict port 80 in the NSG to trusted networks.
• Keep the server private. The Backrest server listens on 127.0.0.1:9898 only and is never exposed directly. Only nginx on port 80 faces the network.
• Protect the administrator password. Authentication is required on the API. The per-VM administrator password lives in /root/backrest-credentials.txt, readable only by root. If you wish, sign in and add or change users from Settings. Keep a copy of the password somewhere safe.
• Guard your encryption passwords. Choose a strong, unique encryption password for every repository. restic encrypts all data at rest with it, and losing it means the backups cannot be recovered.
• Keep the VM patched. The image is patched at build time and ships with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Backrest image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on Azure

Launch Backrest on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Prerequisites

You need an active AWS account, an EC2 key pair in the target region, and a VPC with a subnet.

m5.large (2 vCPU / 8 GiB RAM) is a sensible starting size. Choose a larger size for heavier backup workloads or larger local repositories.

Configure the security group to allow inbound 22/tcp from your management network and 80/tcp for the web interface. Backrest serves plain HTTP on port 80, so for production, terminate TLS in front of it with your own domain. The Backrest server is never exposed directly. It listens on 127.0.0.1:9898 only, so port 9898 stays off the network.

Step 1 - Launch from the AWS Marketplace

In the AWS Marketplace, search for Backrest by SecureAnyCloud, choose Continue to Subscribe and accept the terms. Then choose Continue to Configuration and Continue to Launch.

Pick your region, the recommended m5.large instance type, your VPC and subnet, and a security group that allows SSH (22) and HTTP (80). Select your EC2 key pair and launch. The AMI attaches the dedicated EBS data volume automatically.

Step 2 - Launch with the AWS CLI

aws ec2 run-instances \
  --image-id <backrest-ami-id> \
  --instance-type m5.large \
  --key-name <your-key-pair> \
  --security-group-ids <sg-with-22-and-80> \
  --subnet-id <your-subnet> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=backrest}]'

Find the AMI ID for your region on the product's Launch page in the Marketplace console, or with aws ec2 describe-images filtered by the product's AMI name.

Connecting to your instance

Connect over SSH as the default login user for your operating system variant. For Ubuntu 24.04, the SSH login user is ubuntu. Use the private key for the EC2 key pair you launched with:

ssh -i <your-key.pem> ubuntu@<instance-public-ip>

Step 3 - Confirm the services are running

SSH in and confirm that Backrest and nginx are active. The Backrest server listens only on 127.0.0.1:9898, while nginx serves the web interface on port 80.

systemctl is-active backrest nginx backrest-firstboot

ss -tlnp 2>/dev/null | grep -E ':80 |:9898 ' | awk '{print $1, $4}'

Step 4 - Retrieve the per-instance administrator password

Every instance generates its own administrator password on first boot. It writes the password, along with the login user and URL, to a root-only credentials file. Read it with sudo:

sudo cat /root/backrest-credentials.txt

Sign in to Backrest with username admin and the backrest.admin.pass value from this file. To confirm the login works from the command line, request an authentication token with those credentials:

PASS=$(sudo grep '^backrest.admin.pass=' /root/backrest-credentials.txt | cut -d= -f2-); curl -s -o /dev/null -w 'login HTTP %{http_code}\n' -m 20 -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" http://127.0.0.1/v1.Authentication/Login

Step 5 - Sign in to Backrest

Browse to http://<instance-public-ip>/. Backrest opens on its sign-in screen. Enter username admin and the password from Step 4.

Step 6 - The getting started dashboard

After you sign in, you land on the getting started view. The sidebar gives quick access to Plans, Repositories and Settings. Repositories map directly to restic repositories, and plans configure what to back up and on what schedule.

Step 7 - Add a backup repository

A repository is where restic stores your encrypted, deduplicated snapshots. Click Add Repo in the sidebar to open the repository form.

Give the repository a name. Under Connection, set its location: either a local path such as /var/lib/backrest/repos/main on the data volume, or a remote such as S3, Backblaze B2, SFTP or any restic-supported backend. Then set an encryption password. Use Test Configuration to validate access before saving.

Local repositories live on the dedicated EBS data volume under /var/lib/backrest/repos. They are captured with the volume and kept separate from the operating system disk.

Step 8 - Create a backup plan

A plan tells Backrest what to back up, where, and on what schedule. Click Add Plan and give it a name. Select the repository from Step 7, and add one or more paths to include under Scope.

Then set a Schedule (for example an hourly or daily cron) and a Retention policy to prune old snapshots automatically.

Each time a plan runs, it creates a snapshot in its repository. From the web UI, you can browse snapshots by date and restore individual files or whole directories.

Step 9 - Manage users and authentication

Open Settings from the sidebar to manage the instance identity, users and authentication. The image ships with a single per-instance admin user, created on first boot. From here, you can add further users, change the password or configure multihost identity. Leave Disable Authentication off so a login is always required.

Step 10 - Verify the stack

Confirm the Backrest and restic versions, confirm that the services are enabled, and check that authentication is enforced end to end through nginx:

/usr/local/bin/backrest --version 2>&1 | grep -i version | head -1

/usr/local/bin/restic version | head -1

systemctl is-enabled backrest nginx

PASS=$(sudo grep '^backrest.admin.pass=' /root/backrest-credentials.txt | cut -d= -f2-);
U=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d '{}' http://127.0.0.1/v1.Backrest/GetConfig);
TOK=$(curl -s -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d "{\"username\":\"admin\",\"password\":\"$PASS\"}" http://127.0.0.1/v1.Authentication/Login | sed -n 's/.*"token":"\([^"]*\)".*/\1/p');
A=$(curl -s -o /dev/null -w '%{http_code}' -X POST -H "Authorization: Bearer $TOK" -H 'Content-Type: application/json' -H 'Connect-Protocol-Version: 1' -d '{}' http://127.0.0.1/v1.Backrest/GetConfig); echo "no token: $U with token: $A"

The unauthenticated request returns 401, and the request with the token returns 200. This proves that authentication is enforced on the API:

no token: 401 with token: 200

Step 11 - Where your data lives

The Backrest configuration, its operation log and any local restic repositories live on a dedicated EBS data volume mounted at /var/lib/backrest, separate from the OS disk. The AMI captures this volume and re-provisions it on every instance. Confirm the mount and the filesystem:

df -h /var/lib/backrest | tail -1

findmnt -no SOURCE,TARGET,FSTYPE /var/lib/backrest

Security notes

• Encrypt web traffic. Backrest serves plain HTTP on port 80. For production, put it behind your own TLS-terminating reverse proxy, an Application Load Balancer with an ACM certificate, or CloudFront for your domain, and restrict port 80 in the security group to trusted networks.
• Keep the server private. The Backrest server listens on 127.0.0.1:9898 only and is never exposed directly. Only nginx on port 80 faces the network.
• Protect the administrator password. Authentication is required on the API. The per-instance administrator password lives in /root/backrest-credentials.txt, readable only by root. If you wish, sign in and add or change users from Settings. Keep a copy of the password somewhere safe.
• Guard your encryption passwords. Choose a strong, unique encryption password for every repository. restic encrypts all data at rest with it, and losing it means the backups cannot be recovered.
• Keep the instance patched. The image ships fully patched with unattended security upgrades enabled.

Support

SecureAnyCloud images come with 24/7 support. For questions about this Backrest image or help with your deployment, contact us through the SecureAnyCloud website.

Deploy on AWS

Launch Backrest restic Backup Manager with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com