4 ms·
I've been using tarsnap for years and am in the process of migrating away from it. Things that are not cozy: 1) There's no way to monitor your monthly spend p
by avian 1y ago
I've been using tarsnap for years and am in the process of migrating away from it.
Things that are not cozy:
1) There's no way to monitor your monthly spend per host/credit left on the account/etc. apart of logging into your account in a browser and manually keeping a spreadsheet. There's no web API to do it. You get an email warning when you have about 7 days of credit left. That's it.
2) Nothing is "a precious few megabytes" anymore. What seems like a negligible monthly spend at first can quickly grow up on you and soon you're spending highly non-trivial amounts. Which you might not notice due to 1) unless you are diligent in your accounting.
3) tarsnap restores are slow. Really really slow. A full restore can take days if you have non-trivial amounts of data (and make sure you have enough credit in your account to pay for that server-to-client bandwidth!) My understanding is that throughput is directly related to your latency to the AWS datacenter where tarsnap is hosted. Outside of north America you can be looking at nearly dial-up speeds even on a gigabit link.
Again, a problem that can surprise you at the most inconvenient time. Incremental backups in a daily cronjob tend to transfer very small amounts of data, so you won't notice the slowness until you try to do a full restore. And you generally don't test that very often because you pay for server-to-client transfers.
There are some workarounds for 3) and there's a FAQ about it, but look at the mailing list and you'll see that it's something that surprises people again and again.
- privatelypublic 1y agoSounds like it's just a worse Glacier setup then? Amazon has Pre-Pay in a semi-open beta. CloudFront has 1TB/month free- knocking a large chunk of a restore's cost. (Note- you should have either encrypted your stuff yourself and/or S3 authorization/access control still works over CF) At what seems to be <$2/mo per TB ($1/TB glacier Deep archive + 9cent/gb for metadata on S3 frequent access), no other solution comes close. The big issue is the lump cost of a restore. Which, is quickly worn down by being > $5/TiB/mo cheaper than anybody else.
- amluto 1y agoTarsnap has a nice security model, and it’s quite a challenge to convince any open-source tool to match it.
- dividuum 1y agorestic is basically identical and you can choose where you store your data.
- amluto 1y agorestic can supposedly be set up to prevent a corrupted / compromised client from destroying old data using S3 versioning policy, but this doesn’t appear to be a well-supported feature with clearly-described security properties. Tarsnap, in contrast, has an explicit first-class ability to prevent a compromised client from damaging old backups.
- placardloop 1y agoThat’s because restic is not opinionated about where and how you store your backups. Restic provides a nice interface to create the backups, and then lets you choose where you want to store them (and how access to them is managed), be it locally or via SFTP or S3 or many other backends. Any security properties related to S3 are not in the scope of what restic is meant to do. It’s pretty simple to enable versioning and object lock on your S3 bucket, but it is another step if you’re using restic. Sure, if you just want all of that taken care of for you, you can use tarsnap, but you’re paying a 5x+ premium for it. The other nice thing about restic is that since it’s just the client-side interface, it allows others to provide managed storage. Borgbase.com is a storage backend that is supported by Restic that supports append-only backups, and is cheaper than tarsnap.
- amluto 1y agoI disagree, strongly. Here are the relevant docs: https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html#amazon-s3 https://restic.readthedocs.io/en/stable/030_preparing_a_new_... I would like to see an explicit discussion of what permissions are needed for what operation. I would also like to see a clearly specified model in which backups can be created in a bucket with less than full permissions and, even after active attack by an agent with those same permissions, one can enumerate all valid backups in the bucket and be guaranteed to be able to correctly restore any backup as long as one can figure out which backup one wants to restore. Instead there are random guides on medium.com describing a configuration that may or may not have the desired effect.
- kunley 1y agoI found restic is a prety cool alternative. (No hosting though, I am sending restic backups to a private server/vps)
- muyuu 1y agoyep it's what i'm using right now restic, and my own computers and storage, and the occasional rented device (VPS or similar, typically) i find that the hassle of setting up my stuff is still preferable than having to worry about managing bills, subscriptions, and third parties just changing their policies
- porridgeraisin 1y ago+1 for restic Restic + rclone is a very nice combo. Works really well.
- pbowyer 1y agoSame but with rustic because I found it used significantly less memory. https://rustic.cli.rs/ https://rustic.cli.rs/
- singhrac 1y agoIs it stable? I've been using restic for a while, and I'm interested in rustic, but I have no idea how stable it is overall. Obviously it's still in beta so I won't use it in prod but curious what others experiences have been like.