implementing-immutable-backup-with-restic

# Implementing Immutable Backup with Restic ## When to Use - Establishing ransomware-resistant backup infrastructure with cryptographic integrity verification - Implementing 3-2-1-1-0 backup strategy where the extra 1 is an immutable copy - Automating backup verification workflows that test restore capability on a schedule - Protecting backup repositories from deletion or modification by compromised admin accounts - Meeting compliance requirements for data retention with tamper-proof storage **Do not use** as the sole backup solution without also maintaining offline/air-gapped copies. Object lock protects against logical deletion but not physical storage failure. ## Prerequisites - restic binary installed (https://restic.readthedocs.io/) - S3-compatible storage with Object Lock enabled (AWS S3, MinIO, Backblaze B2) - Python 3.8+ with subprocess module - AWS CLI or MinIO client (mc) configured for bucket access - Sufficient storage for backup repository (typically 2-3x source data with deduplication) ## Workflow ### Step 1: Initialize Restic Repository with Encryption Create an encrypted restic repository on S3-compatible storage with object lock enabled. Restic uses AES-256-CTR for encryption with Poly1305-AES for authentication, ensuring backup data is both confidential and tamper-evident. ### Step 2: Configure Object Lock Retention Enable S3 Object Lock in Compliance mode on the backup bucket to prevent any principal (including root) from deleting or modifying obj...