Automating Daily MySQL/MariaDB Backups with Restic and Encrypted Offsite S3 Storage

Author: Mir Alamin (Principal Web Architect) | Published: July 05, 2026 at 08:50 AM | Reading Time: 21 min read | Category: Maintenance | Tags: Maintenance, Database, Backup, Ubuntu Server Update, Security

Executive Summary

Hardware failures, ransomware attacks, and accidental database drops occur without warning. A robust disaster recovery strategy requires automated, encrypted offsite database backups sent to remote cloud storage (such as AWS S3, Cloudflare R2, or Wasabi).

This technical guide demonstrates setting up automated MariaDB/MySQL database dumping, deduplication, client-side AES-256 encryption, and S3 upload synchronization using Restic.

1. Installing & Initializing Restic Backup Client

Restic is a modern, fast, secure backup program that performs deduplication and encryption natively before data leaves the server.

# Install Restic on Ubuntu
sudo apt install -y restic

# Set S3 Environment Credentials
export AWS_ACCESS_KEY_ID="YourS3AccessKey"
export AWS_SECRET_ACCESS_KEY="YourS3SecretKey"
export RESTIC_REPOSITORY="s3:s3.us-east-1.amazonaws.com/webcarepro-backups-bucket"
export RESTIC_PASSWORD="EncryptionPassword2026!"

# Initialize encrypted repository in S3
restic init

2. Crafting Automated Backup Script (`/usr/local/bin/backup-db.sh`)

#!/bin/bash
# /usr/local/bin/backup-db.sh

set -e

# Export S3 & Restic Env Variables
export AWS_ACCESS_KEY_ID="YourS3AccessKey"
export AWS_SECRET_ACCESS_KEY="YourS3SecretKey"
export RESTIC_REPOSITORY="s3:s3.us-east-1.amazonaws.com/webcarepro-backups-bucket"
export RESTIC_PASSWORD="EncryptionPassword2026!"

BACKUP_DIR="/tmp/db_backups"
TIMESTAMP=$(date +%Y%m%d_%H%M%S)

mkdir -p $BACKUP_DIR

# 1. Dump all databases with single-transaction consistency
mysqldump --all-databases --single-transaction --quick > $BACKUP_DIR/all_databases_$TIMESTAMP.sql

# 2. Run Restic backup to encrypted S3 bucket
restic backup $BACKUP_DIR/all_databases_$TIMESTAMP.sql --tag "mariadb-daily"

# 3. Apply Prune Policy: Keep last 7 daily, 4 weekly, 12 monthly snapshots
restic forget --tag "mariadb-daily" --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

# 4. Clean local temporary dump file
rm -rf $BACKUP_DIR/*

Make backup script executable:

sudo chmod +x /usr/local/bin/backup-db.sh

3. Configuring Systemd Timer for Daily Automation

Create systemd service and timer files rather than relying on legacy crontabs:

# /etc/systemd/system/db-backup.service
[Unit]
Description=Automated Encrypted MariaDB S3 Backup Service
After=network.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup-db.sh

# /etc/systemd/system/db-backup.timer
[Unit]
Description=Run MariaDB S3 Backup Daily at 02:00 AM UTC

[Timer]
OnCalendar=*-*-* 02:00:00
Persistent=true

[Install]
WantedBy=timers.target

Enable and start timer:

sudo systemctl daemon-reload
sudo systemctl enable --now db-backup.timer

4. Continuous Maintenance & Disaster Recovery Services

To ensure your web applications and databases are protected with automated offsite backups:

🛠️ Continuous Website Maintenance Plans
⚙️ Managed Server Administration Plans

5. Frequently Asked Questions (FAQ)

Q1: Why is Restic better than legacy mysqldump cron jobs?

Restic performs client-side AES-256 encryption (protecting data in transit and at rest) and uses content-defined deduplication, saving up to 80% on cloud storage costs.

Q2: How do I restore a database backup from Restic?

Run restic restore latest --target /tmp/restore/ and import the extracted SQL file using mysql < /tmp/restore/all_databases.sql.

Automating Daily MySQL/MariaDB Backups with Restic and Encrypted Offsite S3 Storage

Mir Alamin