Restic — Fast & Secure Encrypted Backup Program

What Restic Does

• Encrypted: AES-256 encryption — backups are secure even on untrusted storage
• Deduplicated: Content-defined chunking means only changed data is stored
• Fast: Parallel processing for backup and restore operations
• Verifiable: Cryptographic integrity verification of all backed-up data
• Incremental: After initial backup, only changes are transmitted
• Snapshots: Each backup creates a snapshot that can be individually browsed and restored
• Cross-Platform: Single binary for Linux, macOS, Windows, FreeBSD
• Multiple Backends: Local, SFTP, S3, B2, GCS, Azure, MinIO, Rclone, REST server

Architecture

Source Files
  → Content-defined chunking (CDC)
  → Deduplicate (skip known chunks)
  → Compress (zstd, since v0.14)
  → Encrypt (AES-256-CTR + Poly1305)
  → Upload to repository backend

Repository Layout:
├── config          — encrypted repo config
├── data/           — encrypted data blobs
├── index/          — chunk index files
├── keys/           — master key (encrypted with password)
├── locks/          — exclusive lock files
└── snapshots/      — snapshot metadata

Storage Backends

# Local directory
restic -r /mnt/backup init

# SFTP
restic -r sftp:user@host:/backup init

# Amazon S3
restic -r s3:s3.amazonaws.com/my-bucket init

# Backblaze B2
restic -r b2:my-bucket:path init

# Google Cloud Storage
restic -r gs:my-bucket:/ init

# Azure Blob
restic -r azure:my-container:/ init

# MinIO (S3-compatible)
restic -r s3:http://minio:9000/backup init

# Rclone (any rclone backend)
restic -r rclone:remote:path init

# REST server (restic's own server)
restic -r rest:http://host:8000/ init

Common Workflows

Daily Backup Script

#!/bin/bash
export RESTIC_REPOSITORY="s3:s3.amazonaws.com/my-backups"
export RESTIC_PASSWORD_FILE="/etc/restic/password"
export AWS_ACCESS_KEY_ID="your-key"
export AWS_SECRET_ACCESS_KEY="your-secret"

# Backup
restic backup /home /etc /var/lib/postgresql 
  --exclude="*.tmp" 
  --exclude=".cache" 
  --exclude="node_modules" 
  --tag daily

# Prune old snapshots
restic forget 
  --keep-daily 7 
  --keep-weekly 4 
  --keep-monthly 12 
  --keep-yearly 3 
  --prune

# Verify integrity
restic check

# Notify
echo "Backup completed: $(restic snapshots --latest 1 --json | jq -r '.[0].short_id')"

Browse & Restore

# List all snapshots
restic snapshots

# Browse snapshot contents
restic ls latest

# Restore entire snapshot
restic restore latest --target /tmp/restore

# Restore specific files
restic restore latest --target /tmp/restore --include "/home/user/documents"

# Mount snapshot as filesystem (read-only)
restic mount /mnt/restic-mount &
ls /mnt/restic-mount/snapshots/latest/

Retention Policies

restic forget 
  --keep-last 5           # Keep 5 most recent
  --keep-daily 7          # Keep 1 per day for 7 days
  --keep-weekly 4         # Keep 1 per week for 4 weeks
  --keep-monthly 12       # Keep 1 per month for 12 months
  --keep-yearly 5         # Keep 1 per year for 5 years
  --prune                  # Actually delete unreferenced data

Performance

Initial backup of 100GB:
  → ~30 minutes (depends on disk/network speed)

Incremental backup (2GB changed):
  → ~2 minutes (only new/changed chunks)

Deduplication ratio (typical):
  → 10 daily backups of 100GB ≈ 110GB stored (not 1TB)

Restic vs Alternatives

FAQ

Q: Restic or BorgBackup — which should I choose? A: Both are excellent deduplicating backup tools. Restic's strengths: a single Go binary, native support for 20+ cloud storage backends, and cross-platform. Borg's strengths: more mature compression (earlier zstd support) and slightly higher performance. Pick Restic for cloud backups; either works for local or SSH-only backups.

Q: What if I lose my password? A: It's unrecoverable. Restic derives its encryption key from your password — there's no "forgot password" option. Store the password in a password manager (e.g., Vaultwarden) and keep a paper backup in a safe place.

Q: Can it be automated? A: Yes. Use cron to schedule backup scripts, supplying the password via the RESTIC_PASSWORD_FILE environment variable. The resticprofile tool can also simplify configuration management.

Sources & Credits

• GitHub: restic/restic — 33K+ ⭐ | BSD-2-Clause
• Website: restic.net