Restic: High-Availability Backup Strategy for Immich and Syncthing

High-Availability Backup Strategy for Immich and Syncthing

(Simplified & Practical Edition – Generic Template)

Overview

This documentis outlinesa theclean, high-availabilitygeneric template of a proven, simple backup strategy forusing thea Immichdedicated photoVault server. To maximize securityLXC and performance,Restic wewith utilizeREST aserver.
Vault-ContainerSeparate architecture.repositories Thisfor ensuresdifferent thatservices, theeasy primaryuser applicationlooping, containerand hasdirect nopruning network— accessminimal tocomplexity, themaximum backup storage, preventing data loss in the event of a service compromise.reliability.

Infrastructure Architecture(Example Layout)

• Hypervisor: Proxmox VE 9.x (ProxmoxVE)
• Primary Application: Immich (LXC ID: 200)
• Backup Controller: Alpine Vault (LXC ID: 250)
• Storage Target: TrueNAS, Synology running Rest Server (Vault-NAS)
• Network Pipe: 10.10.50.0/24 (Direct 2.5GbE Link)

Read-Only

ConfigurationMount StepsPoints in Vault LXC

1. Host

Example ZFS Data Mapping (Proxmox Host) The live Immich data is passed from the ZFS tank to the Vault-LXC as a Read-Only mount point. This prevents the backup container from ever modifying or deleting live production data. # ExecutedDataset on ProxmoxVEHost	Mount pctPoint setin 250Vault -mp0LXC	Purpose
/tank/subvol-200-142-disk-1,mp=1	/mnt/source/photos,immich	Immich library/uploads
/tank/subvol-135-disk-2	/source/syncthing-alice	Syncthing user Alice
/tank/subvol-135-disk-3	/source/syncthing-bob	Syncthing user Bob
/tank/subvol-135-disk-4	/source/syncthing-charlie	Syncthing user Charlie

Configured on Proxmox host with read-only mounts (ro=1).

2.

Restic REST Server (NAS)

Theon NAS runs(10.20.20.80:8000) a

Two Resticseparate RESTrepositories:

in
• /photos Docker→ toauthenticated handlewith incominguser data.photos-backup
The
• /sync-main → authenticated with user sync-backup

--append-only flagis cannot beused, enabledallowing the backup client to preventhandle anypruning networked client from deleting existing snapshots.directly.

Docker Compose Snippet:

services:
  restic-server:
    image: restic/rest-server:latest
    environment:
      - OPTIONS=--append-only --private-repos
    ports:
      - "8000:8000"
    volumes:
      - /mnt/storage/backups/restic:/data

3.

Generic Backup Script (Vault-LXC)

ThePlace scriptthis belowin isthe scheduled via crontab insideVault LXC 250.as It utilizes the high-speed 10.10.50.10 interface for data transfer./root/backup-mountpoints.sh:

#!/bin/bash
# /root/scripts/backup-titan.shSimple exportbackup RESTIC_REPOSITORY=script template for Immich + multi-user Syncthing

# --- CONFIGURATION: IMMICH ---
IMMICH_REPO="rest:http://vault-user:Pass123@10.10.50.10:photos-backup:StrongPhotoPass2025@10.20.20.80:8000/titan"photos"
export RESTIC_PASSWORD=IMMICH_PASS="Encryption_Key_99"StrongPhotoPass2025"

# Perform--- incrementalCONFIGURATION: backupSYNCTHING ---
SYNC_REPO="rest:http://sync-backup:StrongSyncPass2025@10.20.20.80:8000/sync-main"
SYNC_PASS="StrongSyncPass2025"

echo "--- Backup Started: $(date) ---"

# ==========================================
# 1. IMMICH BACKUP
# ==========================================
echo "Backing up Immich..."
RESTIC_PASSWORD=$IMMICH_PASS restic -r $IMMICH_REPO backup /mnt/source/photosimmich \
    --host titan-immich-server --tag "automated"auto" --verbose

# MaintenancePrune Immich repo
RESTIC_PASSWORD=$IMMICH_PASS restic -r $IMMICH_REPO forget \
    --keep-last 3 --keep-daily 7 --keep-weekly 4 --prune

# ==========================================
# 2. SYNCTHING BACKUP
# ==========================================
echo "Backing up Syncthing Users..."
USERS=(Note:"alice" Pruning"bob" must"charlie")

befor USER in "${USERS[@]}"; do
    echo "Processing $USER..."
    RESTIC_PASSWORD=$SYNC_PASS restic -r $SYNC_REPO backup "/source/syncthing-$USER" \
        --host syncthing-server --tag "user:$USER" --verbose
done

locally# onPrune NASSyncthing ifrepo append-only(once isfor active)all users)
RESTIC_PASSWORD=$SYNC_PASS restic snapshots-r $SYNC_REPO forget \
    --keep-last 3 --keep-daily 7 --keep-weekly 4 --prune

echo "--- Backup Finished: $(date) ---"

Security Model

chmod video700 provides/root/backup-mountpoints.sh
achown visualroot:root guide/root/backup-mountpoints.sh
on managing Proxmox mount points and subvolumes, which is the foundational step for sharing your data between the production and backup containers.

To add this to your wiki, append the following section. This documentation will help you remember the logic behind the "Vault" architecture and how to maintain it.

# m h  dom mon dow   command
0 3 * * * /root/immich-backup.backup-all.sh >> /var/log/restic-backup.log 2>&1

/var/log/restic-backup.log {
    daily
    rotate 714
    compress
    missingok
    notifempty
}

• ManualIsolation: LogProduction Check:containers Run(Immich tail& -nSyncthing) 20have /var/log/restic-backup.logno to see the last result.
• Snapshot List: Run restic snapshots to verify that new timestamps are appearing daily.
• Failed Backup Alerts: It is recommended to add a curl command at the end of the script to a service like Healthchecks.io. If the script doesn't run, you will receive an alert.

4. Security Lockdown

Since the script contains encryption passwords and NAS credentials,network access must be restricted to the rootNAS userbackup only.

Recovery Examples

chown# root:rootList Immich snapshots
RESTIC_PASSWORD=StrongPhotoPass2025 restic -r rest:http://photos-backup:...@10.20.20.80:8000/photos snapshots

# Restore latest Immich
RESTIC_PASSWORD=StrongPhotoPass2025 restic -r ... restore latest --target /root/immich-backup.shtmp/restore-immich

chmod# 700List only Bob's snapshots
RESTIC_PASSWORD=StrongSyncPass2025 restic -r ... snapshots --tag user:bob

# Restore Bob's data
RESTIC_PASSWORD=StrongSyncPass2025 restic -r ... restore latest --tag user:bob --target /root/immich-backup.shtmp/restore-bob

This template preserves the simplicity and effectiveness of your working setup while keeping all identifiers generic and secure. Copy, adapt, and deploy confidently!