Backrest Backup Service Setup Guide

This guide walks you through setting up Backrest on TrueNAS Scale to back up both local homelab and remote VPS data to Hetzner Storage Box.

Architecture Overview

Backrest runs on: TrueNAS homelab
Backs up: Local homelab data + remote VPS data (via SSHFS)
Stores backups in: Hetzner Storage Box (via SFTP)
Web UI: Accessible at http://homelab-ip:12001

Prerequisites

TrueNAS Scale system (homelab)
Remote VPS with WireGuard connection to homelab
Hetzner Storage Box configured (see Storage Box setup guide)
Docker and Dockge installed on TrueNAS
FUSE kernel module available (/dev/fuse)
SSH key pair for authentication

Part 1: Prepare SSH Keys

Step 1: Generate SSH Key on Homelab

# Create SSH directory for Backrest
mkdir -p ${CONFIG_PATH}/backrest/ssh
chmod 700 ${CONFIG_PATH}/backrest/ssh

# Generate ED25519 key (no passphrase for automation)
ssh-keygen -t ed25519 -f ${CONFIG_PATH}/backrest/ssh/id_ed25519 -N "" -C "backrest-homelab"

# Set correct permissions
chmod 600 ${CONFIG_PATH}/backrest/ssh/id_ed25519
chmod 644 ${CONFIG_PATH}/backrest/ssh/id_ed25519.pub

Step 2: Authorize Key on Storage Box

# Get your public key
cat ${CONFIG_PATH}/backrest/ssh/id_ed25519.pub

# Connect to Storage Box
sftp -P 23 uXXXXXX@uXXXXXX.your-storagebox.de

# In SFTP session:
mkdir .ssh
chmod 700 .ssh
put ${CONFIG_PATH}/backrest/ssh/id_ed25519.pub .ssh/authorized_keys
chmod 600 .ssh/authorized_keys
bye

Step 3: Authorize Key on VPS

# Copy public key to VPS
ssh-copy-id -i ${CONFIG_PATH}/backrest/ssh/id_ed25519.pub root@VPS_IP

# Or manually:
cat ${CONFIG_PATH}/backrest/ssh/id_ed25519.pub | ssh root@VPS_IP "mkdir -p ~/.ssh && cat >> ~/.ssh/authorized_keys"

Step 4: Add Known Hosts

# Add Storage Box to known_hosts
ssh-keyscan -p 23 uXXXXXX.your-storagebox.de | tee ${CONFIG_PATH}/backrest/ssh/known_hosts

# Add VPS to known_hosts
ssh-keyscan VPS_IP >> ${CONFIG_PATH}/backrest/ssh/known_hosts

# Set permissions
chmod 644 ${CONFIG_PATH}/backrest/ssh/known_hosts

Step 5: Set Correct Ownership

# Backrest container runs as root, so files should be owned by root
sudo chown -R root:root ${CONFIG_PATH}/backrest/ssh

Part 2: Enable FUSE Support

SSHFS requires the FUSE kernel module.

Step 1: Load FUSE Module

# Load FUSE module
sudo modprobe fuse

# Verify it loaded
lsmod | grep fuse

# Verify device exists
ls -l /dev/fuse

Should show: crw-rw-rw- 1 root root 10, 229 ...

Step 2: Make FUSE Persistent (Optional)

To ensure FUSE loads on boot:

# Add to modules
echo "fuse" | sudo tee -a /etc/modules

# Or create systemd service
sudo tee /etc/systemd/system/load-fuse.service << 'EOF'
[Unit]
Description=Load FUSE kernel module
Before=docker.service

[Service]
Type=oneshot
ExecStart=/sbin/modprobe fuse
RemainAfterExit=yes

[Install]
WantedBy=multi-user.target
EOF

sudo systemctl enable load-fuse.service

Part 3: Deploy Backrest with Dockge

Step 1: Create Backrest Stack in Dockge

Create a new stack named backrest with the following compose file:

services:
  backrest:
    image: garethgeorge/backrest:latest
    restart: unless-stopped
    privileged: true
    cap_add:
      - SYS_ADMIN
    devices:
      - /dev/fuse
    environment:
      - BACKREST_PORT=0.0.0.0:9898
      - BACKREST_DATA=/data
      - BACKREST_CONFIG=/config/config.json
      - XDG_CACHE_HOME=/cache
      - TZ=Europe/Brussels
    volumes:
      - ${CONFIG_PATH}/backrest/data:/data
      - ${CONFIG_PATH}/backrest/config:/config
      - ${CONFIG_PATH}/backrest/cache:/cache
      - ${CONFIG_PATH}/backrest/ssh:/root/.ssh:ro
      - /mnt/pool:/mnt/pool:ro
    command: >
      sh -c "
      apk add --no-cache sshfs openssh-client &&
      mkdir -p /mnt/vps &&
      sshfs -o allow_other,StrictHostKeyChecking=no,IdentityFile=/root/.ssh/id_ed25519 root@VPS_IP:/ /mnt/vps &
      sleep 2 &&
      exec /backrest
      "
    ports:
      - 12001:9898

networks: {}

Important replacements:

Replace VPS_IP with your VPS IP address (preferably WireGuard IP like 10.8.0.1)
Replace /mnt/pool with your actual TrueNAS pool mount point
Adjust ${CONFIG_PATH} if needed (or use absolute paths)
Adjust TZ to your timezone

Step 2: Deploy the Stack

In Dockge, click Deploy
Wait for the container to start
Check logs for any errors

Step 3: Verify SSHFS Mount

# Check if VPS is mounted
sudo docker exec backrest-backrest-1 ls /mnt/vps

# Should show VPS directory structure: bin, etc, opt, var, etc.

Step 4: Verify Backrest is Running

# Check logs
sudo docker logs backrest-backrest-1

# Should see: "starting web server" and "addr": "0.0.0.0:9898"

Part 4: Configure Backrest Repository

Step 1: Access Backrest Web UI

Open your browser and navigate to:

http://homelab-ip:12001

Step 2: Initial Settings

On first launch, configure:

Instance ID: homelab-backrest (or any unique name)
Authentication: Create a username and password

Click Save.

Step 3: Add Storage Box Repository

Navigate to Repositories → + Add Repo
Fill in the details:

Repo Details:
- Repo Name: tnt-backup (or your preferred name)
- Repository URI: sftp://uXXXXXX@uXXXXXX.your-storagebox.de:23/tnt-backup
  - Replace uXXXXXX with your Storage Box username
  - The /tnt-backup path will be created automatically
Password:
- Click [Generate] to create a strong encryption password
- CRITICAL: Copy this password and store it securely!
- Without this password, your backups are permanently unrecoverable
Auto Unlock:
- ✅ Check this box (for single-user setup)
Click Test Configuration
- Should show success
Click Submit
- Repository will be initialized

Part 5: Create Backup Plans

Homelab Backup Plan

Navigate to Plans → + Add Plan
Configure:

Plan Details:
- Plan Name: homelab-backup
- Repository: tnt-backup
Backup Scope:
- Paths: Add the following:
  - /mnt/pool/docker
  - /mnt/pool/appdata
  - (Add other important directories)
- Excludes: Add the following:
  - /mnt/pool/media (if media is large and not critical)
  - *.log
  - *.tmp
  - cache/
  - .cache/
Backup Schedule:
- Schedule Type: Cron
- Cron Expression: 0 3 * * 0 (Sunday at 3 AM)
- Reference Clock: Local
Retention Policy:
- By Time Period (selected)
- Hourly: 0
- Daily: 7
- Weekly: 4
- Monthly: 6
- Yearly: 0
Click Submit

VPS Backup Plan

Navigate to Plans → + Add Plan
Configure:

Plan Details:
- Plan Name: vps-backup
- Repository: tnt-backup
Backup Scope:
- Paths: Add the following:
  - /mnt/vps/opt/docker
  - /mnt/vps/etc
- Excludes: Add the following:
  - *.log
  - *.tmp
  - cache/
  - .cache/
Backup Schedule:
- Schedule Type: Cron
- Cron Expression: 0 2 * * 0 (Sunday at 2 AM - 1 hour before homelab)
- Reference Clock: Local
Retention Policy:
- By Time Period (selected)
- Hourly: 0
- Daily: 7
- Weekly: 4
- Monthly: 6
- Yearly: 0
Click Submit

Part 6: Set Up Notifications (Recommended)

Using Healthchecks.io

Create account at Healthchecks.io
Create a check for each backup plan:
- Name: Homelab Backup
- Schedule: Weekly
- Grace Time: 2 hours
In Backrest, edit each backup plan:
- Go to Advanced → Hooks
- Click + Add Hook
- On Success: HTTP GET to healthcheck URL
- On Error: HTTP GET to healthcheck URL/fail
Save the plan

This will alert you if:

Backups fail to run
Backups complete with errors
Backups don’t run on schedule

Part 7: Testing

Test Manual Backup

In Backrest UI, navigate to Plans
Click on homelab-backup
Click Backup Now
Monitor the progress in the UI
Verify backup completes successfully

Repeat for vps-backup.

Test Restore

Navigate to Plans → Select a plan
Click on a completed backup snapshot
Browse files in the backup
Select a file and click Restore
Verify file is restored

Maintenance

Regular Checks

Weekly: Check backup logs for successful completion
Monthly: Run restic check via Backrest to verify repository integrity
Quarterly: Test a full restore operation

Monitoring Storage Usage

Check Storage Box usage in Hetzner Console
Monitor disk graphs in Backrest dashboard
Adjust retention policy if space becomes constrained

Updating Backrest

When new versions are released:

In Dockge, update image tag or pull latest
Redeploy the stack
Verify backups continue to run

Troubleshooting

Container Won’t Start

# Check logs
sudo docker logs backrest-backrest-1

# Common issues:
# - FUSE module not loaded: sudo modprobe fuse
# - SSH key permissions wrong: sudo chown -R root:root ${CONFIG_PATH}/backrest/ssh
# - VPS unreachable: Check WireGuard connection

SSHFS Mount Failed

# Test SSH connection to VPS
ssh -i ${CONFIG_PATH}/backrest/ssh/id_ed25519 root@VPS_IP

# If fails, check:
# - SSH key authorized on VPS
# - VPS firewall allows SSH
# - WireGuard tunnel is up

Backups Failing

# Check Backrest logs
sudo docker logs backrest-backrest-1

# Test Storage Box connection
ssh -p 23 -i ${CONFIG_PATH}/backrest/ssh/id_ed25519 uXXXXXX@uXXXXXX.your-storagebox.de ls

# Verify External Reachability is enabled in Hetzner Console

Web UI Not Accessible

# Verify BACKREST_PORT is set to 0.0.0.0:9898
sudo docker exec backrest-backrest-1 env | grep BACKREST_PORT

# Check if port is listening
sudo docker exec backrest-backrest-1 netstat -tlnp | grep 9898