Backrest
| License | FOSS problems | Maintenance | SSO | Users | Tested |
|---|---|---|---|---|---|
| MITPermissive license. Preserve the copyright notice. Applies only to the covered code — your surrounding project can stay under any license. | — | Active | ❌ | Unlimited | ❌ |
Description
Backrest is a self-hosted web UI over restic, the client-side-encrypted backup tool. It handles scheduling (cron expressions), retention policies (automatic pruning), and S3-compatible remote storage natively, and runs as its own Coolify-deployed service like everything else here.
Features
- Client-side encryption — every restic repository is encrypted (AES-256) before anything leaves the machine, not optional or something to configure, so sensitive data caught up in a volume backup (SSH keys, certs) is protected in transit and at rest automatically.
- Scheduling — cron expressions, built in rather than stitched together separately.
- Retention policies — automatic pruning, so old snapshots don't accumulate indefinitely on their own.
- S3-compatible remote storage — native support, no separate sync step needed to get backups off-site.
Usage patterns
- Off-site infrastructure recovery — bundling restic's scheduling and retention into a web UI means one deployed service covers this entire half of infrastructure recovery, rather than stitching together cron, a bare CLI, and a separate secrets story by hand.
- Volume-level backup only — it only backs up what's actually on disk, the same blind-copy limitation as any volume-level tool (a coverage problem, not a consistency one — see Framework → Security → Backups), so it doesn't understand any single app's data model any better than a raw file copy would.
License and governance
MIT — permissive, no restrictions on self-hosting or modification.
Conclusion
Why you would — one deployed service covers scheduling, retention, and encrypted off-site storage together, instead of assembling restic's CLI, cron, and a separate secrets story by hand.
Why you wouldn't — it's one more service to run and keep patched, for a job that's fundamentally a static configuration plus a schedule rather than something needing a rich UI day to day. And it only ever backs up what's on disk — no better than a raw file copy at understanding any single app's own data model.