Implemented layer
Encrypted Restic repositories
Client VM backups are implemented with Restic. Each repository is encrypted before data leaves the server.
Backups
Backups that are visible before you need them.
ReefOffice backs up client servers with encrypted Restic repositories and shows backup health, key custody, and restore evidence in the client dashboard.
Implemented layer
Hetzner Storage Box target
The production module is built for Hetzner Storage Box over SFTP on port 23 with a dedicated SSH wrapper.
Implemented layer
Hourly schedule and retention
The NixOS module schedules hourly backups with randomized delay and keeps hourly, daily, weekly, and monthly snapshots.
Implemented layer
Restore evidence in the dashboard
The API exposes backup status, restore requests, and restore-drill proof for authenticated clients.
Key custody
Choose the restore model before disaster.
Backup encryption is not only a technical setting. It decides who can perform a restore under pressure. ReefOffice supports both managed recovery and client-held zero-knowledge backup keys.
Standard managed recovery
ReefOffice can escrow an encrypted copy of the Restic key for audited disaster recovery when this mode is selected.
Zero-knowledge backup mode
The server waits for the client-held Restic key before backups can run. ReefOffice cannot restore without the client providing that key.
Dashboard visibility
Clients see backup state, not just a promise.
The backup API checks stored snapshot records and the VM backup-status beacon. It then explains what the state means in plain language.
- ok: a recent backup was confirmed
- stale: no success in the freshness window
- not configured: backup storage is missing
- key pending: zero-knowledge key has not been installed
- unreachable: the backup health beacon cannot be reached
What gets backed up
The backup module includes service data under /opt, Nextcloud data, Vaultwarden state, ReefOffice configuration, and database dumps for supported services.
What is deliberately skipped
Placeholder repositories and missing zero-knowledge keys make the backup unit skip cleanly instead of creating false failed backups or fake success states.
What still needs provisioning
A real backup destination must be configured for each production server. Until then, the dashboard should report storage as not configured rather than healthy.
Related security controls
Backups sit beside disk encryption, not instead of it.
ReefOffice also supports LUKS2 disk encryption during provisioning. LUKS protects server data at rest in a different failure scenario than backups: physical disk or offline snapshot access. Backups protect against deletion, corruption, and recovery events.
Read the full security pageNeed zero-knowledge backups?
We will set the key-custody model before provisioning so the restore workflow matches your risk tolerance.