nicotsx/zerobyte
Zerobyte
ZeroByte is a backup management platform built around the Restic backup engine, providing encrypted, deduplicated, and compressed snapshots across multiple storage backends. It offers a web interface for scheduling, monitoring, and managing backup operations, with support for cron-based job scheduling and configurable retention policies that automatically prune older snapshots.
The platform distinguishes itself through comprehensive multi-protocol volume mounting, allowing backup ingestion from NFS, SMB, WebDAV, SFTP, and rclone-backed sources alongside local directories. It includes a snapshot mirroring mechanism that copies backups to additional repositories after each run for geographic redundancy, and supports OIDC-based single sign-on with organization membership enforcement for team access management. All sensitive credentials are encrypted before storage, with support for environment variable and Docker secret references.
Backup operations can be monitored in real-time through the web interface, which streams file counts and data transfer progress during runs. The notification system delivers alerts across multiple channels including email, Slack, Discord, and webhooks, with configurable pre and post-backup HTTP requests. Storage backends span local disks, S3-compatible services, Google Cloud, Azure Blob, and over 40 rclone-supported providers, with the ability to reuse existing Restic repositories.
The application supports both local directory backup deployment and remote mount capability deployment, with a provisioning file system that reads JSON configuration at startup to define repositories and volumes.
Features
- Restic-Based Engines - Uses Restic as the core backup engine for encrypted, deduplicated, and compressed snapshots across multiple backends.
- OIDC Authentication Integrations - Provides OIDC-based single sign-on with organization membership enforcement and email auto-linking.
- Offsite Snapshot Mirrors - Automatically mirrors each successful snapshot to a second repository for geographic redundancy after every backup.
- Post-Backup Snapshot Mirrors - Copies each snapshot to additional repositories after every backup for geographic redundancy and provider diversification.
- Restorations with Permissions - Restores backed-up files while preserving ownership, permissions, and advanced rules captured in the snapshot.
- Cron-Driven Backup Schedules - Defines a cron expression to run a backup automatically at precise intervals without manual intervention.
- File System Restoration - Writes selected files or folders from a snapshot back onto a filesystem path at the target destination.
- Rclone Cloud Storage Mounts - Provides rclone-based mounting of 40+ cloud storage providers for backup ingestion.
- Cloud Storage Backups - Supports backing up to S3, Google Cloud Storage, Azure Blob, and 40+ rclone backends for remote storage.
- Volume Mounts - Mounts remote filesystems inside the container to back up their contents with permission preservation.
- Multi-Protocol Mounts - Mounts remote filesystems via NFS, SMB, WebDAV, SFTP, or rclone inside the container for centralized backup access.
- Multi-Backend Storage Management - Writes encrypted snapshots to local disks, S3, R2, Google Cloud, Azure, REST servers, SFTP, and 40+ rclone providers.
- SMB Share Mounts - Connects to Windows file shares and Samba servers via SMB/CIFS for backup access.
- Cron Scheduling - Defines backup schedules using cron expressions so recurring tasks run automatically at set intervals.
- Backup Repository Mirrors - Copies snapshots to extra repositories after each backup for geographic redundancy and provider diversification.
- Backup Repositories - Configures and manages storage destinations for encrypted backup data through the web interface.
- Backup Storage Backends - Supports local disks, S3, R2, Google Cloud, Azure, rclone remotes, REST servers, and SFTP as backup destinations.
- Cloud Backups - Sends encrypted backup snapshots to S3, Google Cloud, Azure Blob, and 40+ rclone-supported cloud providers.
- Backup Job Scheduling - Runs backup jobs on cron-defined schedules with configurable retention policies and manual trigger support.
- Encrypted Backup Schedules - Automates recurring backups with encryption, compression, and retention policies across multiple storage backends.
- SFTP Directory Mounts - Mounts remote directories over SSH with password or key authentication for backup ingestion.
- WebDAV Network Drive Mounting - Mounts storage over HTTP/HTTPS via WebDAV with optional authentication for backup access.
- Credential Encryption - Encrypts all stored credentials like passwords and keys before saving them.
- Role-Based Access Management - Scopes access by organization with role-based invitations and SSO.
- Secret Encryption - Encrypts sensitive credentials like passwords and keys before storing them, supporting environment variable and Docker secret references.
- Deduplicated Backup Repositories - Stores backup snapshots in encrypted, deduplicated, and compressed repositories protecting data before it leaves the machine.
- File Tree Selection and Restoration - Inspects a snapshot's file tree and picks specific files or folders to restore, or restores the full snapshot.
- UI-Based File Restoration - Browses snapshot history in the UI and restores individual files, directories, or larger paths without the command line.
- Web Interface Browsing and Restoration - Explores snapshot contents in the web interface and restores them to a filesystem path or downloads selected files.
- Backup Filters - Includes or excludes specific files and directories from backups to refine what data is stored.
- Policy-Based Retention - Keeps configurable numbers of recent, daily, weekly, monthly, and yearly snapshots, automatically pruning older ones.
- Snapshot Mirroring - Copies snapshots to additional repositories after each backup for geographic redundancy and provider diversification.
- Backup Health Alerters - Tracks run status, snapshot history, and repository health, and sends alerts to multiple channels.
- Downloads from Snapshots - Retrieves file contents from a backup without writing them to the original mount for one-off recovery.
- Elevated Capability - Runs the container with elevated capabilities to mount NFS, SMB, WebDAV, and SFTP volumes directly.
- Repository Doctor Checks - Runs unlock, integrity checks, and index repairs with step-by-step reports and health status updates.
- Backup Snapshot Mirroring - Copies snapshots to additional repositories for geographic redundancy or provider diversification.
- Backup Volume Provisioning - Creates and manages mountable data sources from a JSON configuration file supporting multiple protocols.
- Backup Repository Provisioning - Creates and manages backup destinations from a JSON configuration file supporting multiple storage backends.
- Cloud Storage - Mounts cloud storage as a filesystem inside the container so its data can be selected as a backup source.
- Provisioning Files - Reads a JSON provisioning file at startup to define repositories and volumes for operator-managed infrastructure.
- Manual Job Triggering - Triggers an immediate backup run from the web interface, bypassing the scheduled cron expression.
- Pre and Post Backup Webhooks - Ships configurable pre and post-backup webhooks for automating service preparation and cleanup.
- Container Directory Mounting - Mounts host directories as read-only volumes to make them available for local directory backups.
- NFS Client Mounts - Connects to an NFS export from a NAS or file server, supporting protocol versions 3, 4, and 4.1 for backup access.
- Compression Mode Selection - Offers compression mode selection to balance CPU usage against storage space and bandwidth.
- Provisioning File Mounts - Mounts a JSON provisioning file at startup to define operator-managed repositories and volumes.
- Group Membership Enforcement - Blocks SSO sign-in unless the user has valid organization membership.
- OIDC Integrations - Allows registering OpenID Connect providers for organization SSO.
- SSH Private Key Authentications - Authenticates SFTP remotes using SSH keys, agent forwarding, or embedded keys.
- Backup Repository Health Maintenance - Provides web interface tools for doctor checks, unlocking stale repositories, and refreshing statistics.
- Backup Repository Maintenance Tasks - Performs health checks, unlocks stale locks, and refreshes compression statistics through the web interface.
- Recovery Key Downloads - Provides a recovery key download so backups remain accessible if server access is lost.
- Backup Event Notifications - Sends alerts for start, success, warning, or failure events to a chosen destination per backup schedule.
- Post-Backup Webhooks - Executes an HTTP request after Restic finishes, enabling cleanup or resumption of services based on backup outcome.
- Verification Restorations - Recovers files from a stored snapshot to a non-production path so the user can verify the backup is restorable.
- Backup Health Alerters - Sends alerts about run status, next backup time, snapshot history, and repository health to multiple channels.
- Multi-Channel Notification Workflows - Supports Email, Slack, Discord, Gotify, ntfy, Pushover, Telegram, Generic Webhook, and custom Shoutrrr URLs as notification destinations.
- Backup Progress Streams - Streams real-time file counts, data processed, and upload progress through the web interface during a backup run.
- Webhook Notifications - Sends HTTP requests before and after backups to external services for automation and alerting.
- Pre-Backup Webhooks - Provides pre-backup webhooks to pause services or create database dumps before snapshots.
- Backup Job Status Monitors - Tracks the status and history of backup jobs through a web interface to verify successful execution.
- Backup Repository Definitions - Defines backup destinations and storage backends in a structured JSON file read at startup.
- Backup Volume Definitions - Defines mountable storage sources and access protocols in a structured JSON file read at startup.
