# Restic — Fast & Secure Encrypted Backup Program

> Restic is a modern backup program with encryption, deduplication, and support for 20+ storage backends. Single binary, fast incremental backups, and easy restores.

## Install

Save the content below to `.claude/skills/` or append to your `CLAUDE.md`:

## Quick Use

```bash
# Install
brew install restic  # macOS
apt install restic   # Debian/Ubuntu

# Initialize repository
restic -r /path/to/backup init

# Create backup
restic -r /path/to/backup backup ~/Documents

# List snapshots
restic -r /path/to/backup snapshots

# Restore
restic -r /path/to/backup restore latest --target /tmp/restore
```

## Intro

**Restic** is a fast, secure, and efficient backup program written in Go. It encrypts all data with AES-256 before storing it, deduplicates at the chunk level, and supports 20+ storage backends including local disks, SFTP, S3, Backblaze B2, Google Cloud, and Azure Blob Storage.

With 33K+ GitHub stars and BSD-2-Clause license, Restic is the most popular command-line backup tool, valued for its simplicity, speed, and cryptographic design that ensures backups are secure even on untrusted storage.

## What Restic Does

- **Encrypted**: AES-256 encryption — backups are secure even on untrusted storage
- **Deduplicated**: Content-defined chunking means only changed data is stored
- **Fast**: Parallel processing for backup and restore operations
- **Verifiable**: Cryptographic integrity verification of all backed-up data
- **Incremental**: After initial backup, only changes are transmitted
- **Snapshots**: Each backup creates a snapshot that can be individually browsed and restored
- **Cross-Platform**: Single binary for Linux, macOS, Windows, FreeBSD
- **Multiple Backends**: Local, SFTP, S3, B2, GCS, Azure, MinIO, Rclone, REST server

## Architecture

```
Source Files
  → Content-defined chunking (CDC)
  → Deduplicate (skip known chunks)
  → Compress (zstd, since v0.14)
  → Encrypt (AES-256-CTR + Poly1305)
  → Upload to repository backend

Repository Layout:
├── config          — encrypted repo config
├── data/           — encrypted data blobs
├── index/          — chunk index files
├── keys/           — master key (encrypted with password)
├── locks/          — exclusive lock files
└── snapshots/      — snapshot metadata
```

## Storage Backends

```bash
# Local directory
restic -r /mnt/backup init

# SFTP
restic -r sftp:user@host:/backup init

# Amazon S3
restic -r s3:s3.amazonaws.com/my-bucket init

# Backblaze B2
restic -r b2:my-bucket:path init

# Google Cloud Storage
restic -r gs:my-bucket:/ init

# Azure Blob
restic -r azure:my-container:/ init

# MinIO (S3-compatible)
restic -r s3:http://minio:9000/backup init

# Rclone (any rclone backend)
restic -r rclone:remote:path init

# REST server (restic's own server)
restic -r rest:http://host:8000/ init
```

## Common Workflows

### Daily Backup Script

```bash
#!/bin/bash
export RESTIC_REPOSITORY="s3:s3.amazonaws.com/my-backups"
export RESTIC_PASSWORD_FILE="/etc/restic/password"
export AWS_ACCESS_KEY_ID="your-key"
export AWS_SECRET_ACCESS_KEY="your-secret"

# Backup
restic backup /home /etc /var/lib/postgresql 
  --exclude="*.tmp" 
  --exclude=".cache" 
  --exclude="node_modules" 
  --tag daily

# Prune old snapshots
restic forget 
  --keep-daily 7 
  --keep-weekly 4 
  --keep-monthly 12 
  --keep-yearly 3 
  --prune

# Verify integrity
restic check

# Notify
echo "Backup completed: $(restic snapshots --latest 1 --json | jq -r '.[0].short_id')"
```

### Browse & Restore

```bash
# List all snapshots
restic snapshots

# Browse snapshot contents
restic ls latest

# Restore entire snapshot
restic restore latest --target /tmp/restore

# Restore specific files
restic restore latest --target /tmp/restore --include "/home/user/documents"

# Mount snapshot as filesystem (read-only)
restic mount /mnt/restic-mount &
ls /mnt/restic-mount/snapshots/latest/
```

### Retention Policies

```bash
restic forget 
  --keep-last 5           # Keep 5 most recent
  --keep-daily 7          # Keep 1 per day for 7 days
  --keep-weekly 4         # Keep 1 per week for 4 weeks
  --keep-monthly 12       # Keep 1 per month for 12 months
  --keep-yearly 5         # Keep 1 per year for 5 years
  --prune                  # Actually delete unreferenced data
```

## Performance

```
Initial backup of 100GB:
  → ~30 minutes (depends on disk/network speed)

Incremental backup (2GB changed):
  → ~2 minutes (only new/changed chunks)

Deduplication ratio (typical):
  → 10 daily backups of 100GB ≈ 110GB stored (not 1TB)
```

## Restic vs Alternatives

| Feature | Restic | BorgBackup | Duplicati | Rclone |
|---------|--------|------------|-----------|--------|
| Language | Go | Python/C | C# | Go |
| Encryption | AES-256 (always) | AES-256 | AES-256 | Crypt |
| Deduplication | CDC chunks | CDC chunks | Block-level | None |
| Compression | zstd (v0.14+) | lz4/zstd | Zip/7z | None |
| Backends | 20+ | Local/SSH | 20+ (GUI) | 40+ |
| GUI | No (CLI) | No (CLI) | Web UI | Web UI |
| Platform | All | Linux/macOS | All | All |
| Mount snapshots | Yes (FUSE) | Yes (FUSE) | No | Yes |

## FAQ

**Q: Restic or BorgBackup — which should I choose?**
A: Both are excellent deduplicating backup tools. Restic's strengths: a single Go binary, native support for 20+ cloud storage backends, and cross-platform. Borg's strengths: more mature compression (earlier zstd support) and slightly higher performance. Pick Restic for cloud backups; either works for local or SSH-only backups.

**Q: What if I lose my password?**
A: It's unrecoverable. Restic derives its encryption key from your password — there's no "forgot password" option. Store the password in a password manager (e.g., Vaultwarden) and keep a paper backup in a safe place.

**Q: Can it be automated?**
A: Yes. Use cron to schedule backup scripts, supplying the password via the `RESTIC_PASSWORD_FILE` environment variable. The resticprofile tool can also simplify configuration management.

## Sources & Credits

- GitHub: [restic/restic](https://github.com/restic/restic) — 33K+ ⭐ | BSD-2-Clause
- Website: [restic.net](https://restic.net)

---
Source: https://tokrepo.com/en/workflows/restic-fast-secure-encrypted-backup-program-a1edbdb2
Author: Script Depot