Configuration

ResticGUI reads config.yaml from the folder it starts in: /etc/resticgui with the Linux service, /opt in the Docker image and on Kubernetes. It is read once at start: restart ResticGUI after a change.

Repositories, schedules, retention, hooks and notifiers are not in this file: they are set in the web interface and kept in the database.

Settings

Key	Default	What it does
server.ip	127.0.0.1	Address to listen on. 0.0.0.0 listens on every address: set a password first.
server.allowed_hosts	[]	Without a login, the host names the server answers to besides IP addresses and localhost, such as [backup.lan]. Other names are refused, so that a web page cannot reach the API through a domain that resolves to this machine (DNS rebinding). Not needed with a password.
server.port	3001	Port of the web interface and the API. The images use 3030.
store.path	resticgui.sqlite	The SQLite database, created on the first start.
store.key_file	resticgui.key	The key that encrypts repository passwords and credentials, created on the first start. $RESTICGUI_SECRET_KEY (a base64 32-byte key) takes its place when set.
store.legacy_path	resticgui.db	A database of ResticGUI 0.1, imported once when store.path does not exist yet. "" turns the import off. See upgrading.
restic.bin	restic	The restic binary, a path or a name found in PATH. restic 0.17 or later.
jobs.workers	2	How many restic commands may run at once, across repositories. Each repository runs one at a time.
jobs.schedule	true	Run the schedules. false leaves only the jobs started by hand.
paths.roots	[]	Folders that may be backed up, browsed and restored into. Empty allows every path.
auth.username	admin	The login name.
auth.password_hash	""	A bcrypt hash from resticgui hash-password. Empty turns the login off: anyone who reaches the server can use it.
hooks.commands	false	Allow command hooks, which run with ResticGUI's rights. Webhooks need no setting.
metrics.enabled	false	Serve Prometheus metrics at /metrics.
metrics.token	""	When set, /metrics needs Authorization: Bearer <token>.
logs.level	1	0 debug, 1 info, 2 warnings, 3 errors only.
logs.debug	false	Debug logs, whatever logs.level says.

A complete file

logs:
  debug: false
  level: 1

server:
  ip: "127.0.0.1"
  port: 3001
  # host names the server is reached by without a login, besides IP
  # addresses and localhost; others are refused against DNS rebinding
  allowed_hosts: []

store:
  # SQLite database, created on the first start
  path: resticgui.sqlite
  # key that encrypts repository passwords and credentials; $RESTICGUI_SECRET_KEY wins
  key_file: resticgui.key
  # database of ResticGUI v0.1, imported once when path does not exist yet
  legacy_path: resticgui.db

restic:
  bin: restic

jobs:
  # how many restic commands may run at once (one per repository at most)
  workers: 2
  # run the backup, forget/prune and check schedules
  schedule: true

paths:
  # directories that may be backed up, restored into and browsed; empty allows all
  roots: []

auth:
  # leave password_hash empty to run without a login (only on a trusted network)
  # make a hash with: resticgui hash-password
  username: admin
  password_hash: ""

hooks:
  # allow command hooks, which run before and after backups with ResticGUI's
  # rights; webhooks need no setting. See https://docs.resticgui.com/features/hooks
  commands: false

metrics:
  # serve Prometheus metrics at /metrics. See https://docs.resticgui.com/features/metrics
  enabled: false
  # when set, scrapes must send "Authorization: Bearer <token>"
  token: ""

Environment

Variable	What it does
RESTICGUI_SECRET_KEY	The encryption key, base64, instead of store.key_file: openssl rand -base64 32.
TZ	The time zone of the schedules, such as Europe/Paris.
RESTIC_CACHE_DIR	Where restic keeps its cache; by default ~/.cache/restic.
HTTPS_PROXY, NO_PROXY	A proxy for the cloud storages.
GIN_MODE=release	Quieter HTTP logs; the images set it.

ResticGUI passes restic only the variables it needs (PATH, HOME, TZ, the cache, certificate and proxy settings, SSH_AUTH_SOCK) and the credentials of the repository at hand, never its own secrets.

Commands

Command	Does
resticgui	Starts the server.
resticgui version	Prints the version.
resticgui hash-password	Reads a password and prints its hash for auth.password_hash.
resticgui migrate-legacy -from OLD.db -to NEW.db [-key-file FILE]	Imports a ResticGUI 0.1 database by hand.