Restic backup guide: encryption, snapshots, and restores

Restic is an open-source backup program that creates encrypted, deduplicated snapshots in a repository. It can write to local storage and several remote or S3-compatible backends. Each snapshot records the state of the selected paths at a point in time.

Restic encrypts repository data and metadata. The repository password is therefore part of the recovery system: losing it can make otherwise healthy backup data unusable.

A practical lifecycle includes repository initialization, scheduled backups, retention, periodic integrity checks, and restore tests. Each stage should produce an observable result rather than disappearing into unattended cron output.

• Initialize the repository and securely record its password.
• Back up explicit paths and exclude caches or transient data intentionally.
• Apply a retention policy and prune unused data on a suitable schedule.
• Run repository checks and restore representative data regularly.

Restic snapshots are incremental in storage use because unchanged data is deduplicated, but every snapshot still represents a complete recovery view. Retention commands select which snapshots to keep; pruning removes unreferenced data from the repository.

Choose retention from recovery requirements, not an arbitrary snapshot count. Preserve dense recent history and less frequent long-term points when that matches the risks you need to cover.

Document the repository location, required credentials, password retrieval process, and target paths. Restore into a separate directory first unless the recovery procedure specifically calls for an in-place restore. For databases, prefer an application-consistent dump or a database-aware procedure over copying live data files.