Encrypted, Automatic Backups with restic

Hello, tech enthusiasts! 👋

The end of the year is a good time for a question: if your laptop died today, what would you lose? Your reports, your scripts, your invoice archive?

Many people copy files to a USB disk “sometimes”. But sometimes means “not last month”. And a plain copy on a disk is readable by anyone who finds that disk.

Today we fix both problems with restic. It makes backups that are encrypted, small, and automatic.

What you need

  • A Linux or Mac computer (restic also works on Windows)
  • An external disk, or a server you can reach with SFTP
  • restic, free from https://restic.net
  • About 20 minutes

Step 1: Understand how restic works

restic keeps your backups in a repository. A repository is a folder that holds all your backups, locked with a password. Inside, everything is encrypted: without the password, the data is just noise.

Each backup is called a snapshot. A snapshot is like a photo of your folders at one moment. restic is smart: it only stores the parts of files that changed. So 30 nightly snapshots do not take 30 times the space.

Step 2: Install restic

On Ubuntu or Debian:

sudo apt install restic

On a Mac with Homebrew:

brew install restic

Step 3: Create the repository

First, choose a strong password and store it in a file only you can read:

mkdir -p ~/.config/restic
nano ~/.config/restic/password     # type a long password, save
chmod 600 ~/.config/restic/password

Now tell restic where things are. We use environment variables, which are like sticky notes the terminal can read:

export RESTIC_REPOSITORY=/media/backupdisk/restic-repo
export RESTIC_PASSWORD_FILE=~/.config/restic/password
restic init

Using a server instead of a disk? Use an SFTP address. Your SSH key login must already work:

export RESTIC_REPOSITORY=sftp:backupuser@backup.example.com:/srv/restic-repo
restic init

Very important: if you lose the password, your backups are gone forever. Nobody can open them, not even you. Save a copy of the password in a password manager or on paper in a safe place.

Step 4: Make your first backup

restic backup ~/Documents ~/Scripts --exclude "*.tmp"

The first backup takes the longest. Later ones are much faster. Let us check what we have:

restic snapshots

You will see a list with an ID, date, and folders for each snapshot.

Step 5: Restore one file

This is the reason we do backups. Say you deleted sales_2024.xlsx by mistake. First, find it:

restic find sales_2024.xlsx

Then restore it from the latest snapshot into a safe folder:

restic restore latest --target ~/restored --include "/home/youruser/Documents/sales_2024.xlsx"

The file appears inside ~/restored, with its full folder path. Check it, then copy it back. You can also use a snapshot ID instead of latest to go further back in time.

Tip: test a restore now, while nothing is wrong. A backup you never tested is only a hope.

Step 6: Clean up old snapshots

You do not need every nightly snapshot forever. Tell restic which ones to keep:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

This keeps the last 7 days, the last 4 weeks, and the last 6 months. forget removes the old snapshots from the list. --prune actually deletes the data nobody needs anymore, to free space.

Once in a while, check that the repository is healthy:

restic check

Step 7: Make it automatic with cron

Cron is the Linux alarm clock. It runs commands at fixed times. First, put everything in a small script, ~/backup.sh:

#!/bin/bash
# Nightly restic backup
export RESTIC_REPOSITORY=/media/backupdisk/restic-repo
export RESTIC_PASSWORD_FILE=$HOME/.config/restic/password

restic backup ~/Documents ~/Scripts --exclude "*.tmp" &&
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Make it runnable:

chmod 700 ~/backup.sh

Open your cron list with crontab -e and add this line. It runs the script every night at 02:00 and writes a log:

0 2 * * * $HOME/backup.sh >> $HOME/backup.log 2>&1

Check backup.log the next morning to see that it worked.

Common problems

  • “Fatal: unable to open config file” → The repository path is wrong, or the disk is not plugged in.
  • “wrong password or no key found” → Check the password file. There must be no extra spaces.
  • “repository is already locked” → An old backup was stopped halfway. If no backup is running now, run restic unlock.
  • Cron job does nothing → Cron uses a very small environment. Use full paths in the script, and read backup.log.

Wrap-up

You now have backups that are encrypted, run every night, and clean up after themselves. And you know how to get a single file back in under a minute.

Next idea: follow the “3-2-1” rule. Keep 3 copies of your data, on 2 different kinds of storage, with 1 copy in another place. A second restic repository on a remote server is an easy way to get there. 🔐

fsaeed

, , , ,