On Linux

ResticGUI runs as a systemd service. As root it can read every file it backs up and restore files with their owners.

1. Install restic and ResticGUI

Install restic 0.17 or later from your distribution or from the restic releases:

sudo apt install restic          # Debian, Ubuntu
sudo dnf install restic          # Fedora
restic version                   # 0.17.0 or later

Then download ResticGUI from the releases. Set VERSION to the newest one and ARCH to amd64, arm64 or armv7:

VERSION=0.2.0
ARCH=amd64
curl -fLO "https://github.com/mathieuHa/resticgui/releases/download/v$VERSION/resticgui_${VERSION}_linux_$ARCH"
curl -fLO "https://github.com/mathieuHa/resticgui/releases/download/v$VERSION/SHA256SUMS"
sha256sum --ignore-missing -c SHA256SUMS
sudo install -m 755 "resticgui_${VERSION}_linux_$ARCH" /usr/local/bin/resticgui
resticgui version

2. Configure it

ResticGUI reads config.yaml from the folder it starts in. Put it in /etc/resticgui:

base=https://raw.githubusercontent.com/mathieuHa/resticgui/main/deploy/linux
sudo mkdir -p /etc/resticgui
sudo curl -fL -o /etc/resticgui/config.yaml "$base/config.yaml"
sudo curl -fL -o /etc/systemd/system/resticgui.service "$base/resticgui.service"

The configuration keeps the interface on this machine and lists the folders it may back up. Change paths.roots to yours, and restic.bin if restic is not in /usr/local/bin (command -v restic tells):

# /etc/resticgui/config.yaml; all the settings: https://docs.resticgui.com/reference/configuration
server:
  # 127.0.0.1 keeps it on this machine; 0.0.0.0 opens it to the network,
  # set auth.password_hash first
  ip: 127.0.0.1
  port: 3001

store:
  path: /var/lib/resticgui/resticgui.sqlite
  key_file: /var/lib/resticgui/resticgui.key
  legacy_path: ""

restic:
  bin: /usr/local/bin/restic

paths:
  # the folders that may be backed up and restored into; empty allows all
  roots: [/home, /etc, /srv]

auth:
  username: admin
  # sudo resticgui hash-password, then paste the hash here
  password_hash: ""

The configuration reference lists every setting.

3. Start it

[Unit]
Description=ResticGUI, a web interface for restic backups
Documentation=https://docs.resticgui.com
Wants=network-online.target
After=network-online.target

[Service]
# root, so that backups can read every file; see the docs to run it as
# another user
User=root
WorkingDirectory=/etc/resticgui
ExecStart=/usr/local/bin/resticgui
Restart=on-failure
RestartSec=5
Environment=GIN_MODE=release
# schedules follow this time zone
#Environment=TZ=Europe/Paris
StateDirectory=resticgui
CacheDirectory=resticgui
Environment=RESTIC_CACHE_DIR=/var/cache/resticgui

# Root reads every file it backs up and restores files with their owners;
# these keep it to the rights that needs. Command hooks run under them too:
# widen CapabilityBoundingSet if one needs more.
CapabilityBoundingSet=CAP_CHOWN CAP_DAC_OVERRIDE CAP_DAC_READ_SEARCH CAP_FOWNER CAP_FSETID
NoNewPrivileges=yes
PrivateTmp=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectKernelLogs=yes
ProtectControlGroups=yes
ProtectClock=yes
ProtectHostname=yes
LockPersonality=yes
RestrictRealtime=yes
RestrictNamespaces=yes
SystemCallArchitectures=native

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable --now resticgui
systemctl status resticgui

Open http://127.0.0.1:3001/ui/. On a server without a desktop, reach it through SSH from your computer:

ssh -L 3001:127.0.0.1:3001 you@server

then open the same URL on your computer. Continue with your first backup.

Logs and updates

journalctl -u resticgui -f       # what it does
sudo systemctl stop resticgui    # then install the new binary as in step 1
sudo systemctl start resticgui

The database and its encryption key are in /var/lib/resticgui. Back up resticgui.key somewhere safe: without it, the saved repository passwords and credentials cannot be read. The repositories themselves only need their own password.

Open it to your network

Set a password first, then listen on every address:

sudo resticgui hash-password     # type the password, copy the hash
sudoedit /etc/resticgui/config.yaml

server:
  ip: 0.0.0.0
auth:
  username: admin
  password_hash: "$2a$10$..."    # the hash

sudo systemctl restart resticgui

Prefer HTTPS through a reverse proxy, as security explains.