URBM is a native Unraid 7 plugin that manages encrypted, deduplicated and versioned backups through Restic. It supports shares, appdata, Docker metadata and data, VM definitions and disks, and the Unraid boot drive. Destinations can be local, SFTP, SMB or NFS.

USB flash jobs always back up the browsable /boot file tree and can optionally stream the complete physical boot device into Restic as urbm-usb-flash.img for block-level recovery to an equal-sized or larger replacement device.

URBM also supports scheduled direct Rsync copies. Sources and the destination are selected with folder browsers; overwrite, destination deletion, permissions, ownership, timestamps, links, ACLs, extended attributes, checksum comparison, and dry-run behavior are configured without free-form shell arguments.

URBM is an independent community plugin and is not affiliated with or endorsed by Lime Technology, Inc.

Architecture

urbmd is a static Go daemon with a single global task queue and an HTTP API on /run/urbm/urbm.sock.
The Unraid PHP page proxies authenticated WebGUI requests to that Unix socket.
Persistent configuration and AES-256-GCM encrypted secrets live in /boot/config/plugins/urbm.
Runtime secrets and transient metadata live below /run/urbm and are deleted after each operation.
Restic 0.19.0 is pinned and checksum-verified by the package build.

Development

Requirements: Go 1.23+, Node.js, curl, bzip2, tar, and sha256sum.

./scripts/check.sh
./packaging/build-package.sh

The package is written to dist/. Replace REPLACE_DURING_RELEASE in the copied PLG manifest with the generated package checksum before publishing a release.

Unraid installation

Install the generated manifest URL through Unraid's Plugins page:

https://git.casaderoll.de/michael/URBM/raw/branch/main/dist/urbm.plg

Configuration is retained when uninstalling so repositories remain recoverable.

Security model

The daemon has no TCP listener. Restic passwords are passed through root-only temporary files, never command-line arguments. Automatic boot unlock protects against accidental disclosure but does not protect against root compromise or theft of the complete flash drive. In-place restores require explicit confirmation and protected system roots are rejected.

Current scope

The code implements the MVP control plane and adapters. Docker and VM operations require the standard Unraid docker and virsh commands. Managed SMB/NFS mounts require the corresponding Unraid mount helpers. Hardware and end-to-end compatibility must be validated on supported Unraid 7 releases before a stable publication.