Files and directories backup

The Sard agent reads the paths you name and saves them into a restic repository: S3, SFTP or a local disk. The source is only read.

What you configure

paths: 1 to 64 absolute paths, none inside another.
exclude: restic exclude patterns.
one_file_system: do not cross into other filesystems.
control_paths: files and directories that must exist and be non-empty on every backup.

{"paths": ["/etc", "/var/www"], "exclude": ["*.log", "/var/www/cache"], "one_file_system": true}

A backup that does not pretend to succeed

Control paths catch an unmounted disk: without them an empty directory would be saved “successfully”. A control path that is missing or empty fails the step before restic starts.

If some files are unreadable, restic still creates a snapshot without them, and the step fails: a silently incomplete backup is worse than a failed one. The snapshot stays in the repository marked “incomplete” and does not count as a success. The console shows the number of files and the first paths.

A fingerprint for restore verification

Before the backup the agent hashes (SHA-256) a random sample of files, up to 100 by default, and saves the fingerprint as a separate snapshot. The verifier restores the snapshot on its own machine and compares the copy with the fingerprint: control paths, sample hashes, the number of files and their volume.

Read permissions

Files are read as the sard-agent user, so it needs permissions on the paths. If it lacks them, the backup fails and names the unreadable paths.