Restic

Cheatsheet#restic

restic creates fast, secure, deduplicated snapshot backups. Every backup is an incremental snapshot, but functions as a full backup when restoring. All data is encrypted by default.

Repository Setup

A repository is where your backups live. You only initialize it once.

# Initialize local repository
restic -r /srv/restic-repo init
 
# Initialize SFTP repository
restic -r sftp:[email protected]:/srv/restic-repo init
 
# Initialize Amazon S3 / Cloudflare R2 repository
export AWS_ACCESS_KEY_ID="my_key"
export AWS_SECRET_ACCESS_KEY="my_secret"
restic -r s3:https://s3.amazonaws.com/my-bucket-name init

Tip: You can avoid typing the password by exporting RESTIC_PASSWORD="my_password" in your terminal or cron script.

Creating Snapshots (Backups)

# Create a backup of /var/www and /etc
restic -r /srv/restic-repo backup /var/www /etc
 
# Backup with verbose output
restic -r /srv/restic-repo --verbose backup /var/www
 
# Exclude specific files or directories
restic -r /srv/restic-repo backup /var/www --exclude="*.log" --exclude="/var/www/cache"

Inspecting Backups

# List all snapshots in the repository
restic -r /srv/restic-repo snapshots
 
# List files inside a specific snapshot
restic -r /srv/restic-repo ls 0a1b2c3d
 
# Check repository integrity (find corruption)
restic -r /srv/restic-repo check

Restoring Data

# Restore specific snapshot to a directory
restic -r /srv/restic-repo restore 0a1b2c3d --target /tmp/restore
 
# Restore the LATEST snapshot of a specific directory
restic -r /srv/restic-repo restore latest --target /tmp/restore --path /var/www

Mounting Backups as a Drive

This is Restic's "killer feature". You can mount the entire backup repository as a read-only filesystem and browse snapshots natively using cd and cat.

# Create a mount point
mkdir /mnt/restic
 
# Mount the repository
restic -r /srv/restic-repo mount /mnt/restic
 
# Now you can browse snapshots like folders:
# cd /mnt/restic/snapshots/latest/var/www/
 
# To unmount when done:
fusermount -u /mnt/restic

Pruning Old Backups (Retention Policy)

Because restic deduplicates, deleting an old snapshot doesn't free space until you run --prune. Restic has a powerful forget command to keep certain numbers of daily, weekly, and monthly backups.

# Keep the last 7 daily, 4 weekly, and 12 monthly backups. Delete the rest.
restic -r /srv/restic-repo forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 12 \
  --prune