Encrypted, deduplicated VPS backups with restic

restic is a fast, open-source backup tool that encrypts everything client-side and deduplicates data, so daily backups take little space and time. This guide shows how to make restic backups for a VPS to S3-compatible storage or an SFTP server.

Before you start

• A Linux VPS with sudo.
• A destination: an S3-compatible bucket (see object storage) or another server reachable by SFTP.
• A safe place to store the repository password; without it backups cannot be restored.

Install restic

sudo apt install -y restic

RHEL family: install from EPEL. The official releases page offers newer static binaries.

Set credentials

Create /root/.restic-env (mode 600):

export RESTIC_REPOSITORY="s3:https://s3.provider.example/my-backups/vps1"
export AWS_ACCESS_KEY_ID="your-key"
export AWS_SECRET_ACCESS_KEY="your-secret"
export RESTIC_PASSWORD_FILE="/root/.restic-pass"

For SFTP use RESTIC_REPOSITORY="sftp:backup@backup.example.com:/srv/restic/vps1" with SSH key login. Put a long random password in /root/.restic-pass and keep a copy off the server.

Initialise the repository

source /root/.restic-env && restic init

Back up

Dump databases first, then back up:

mysqldump --all-databases --single-transaction | gzip > /var/backups/db.sql.gz

restic backup /etc /var/www /var/backups --exclude-caches --tag daily

Apply retention

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

forget removes snapshot references and --prune deletes unused data.

Verify

restic check

Occasionally add --read-data-subset=5% to verify actual data blocks.

Restore

restic snapshots

restic restore latest --target /tmp/restore --include /var/www/site1

Practise restores regularly; see disaster recovery planning.

Automate

Put the commands in a script and run it with a systemd timer or cron; see systemd timers. Log output and alert on failures.

Troubleshooting

• "repository is already locked": a previous run crashed; after confirming nothing is running, restic unlock.
• Access denied on S3: key lacks bucket permissions, or the endpoint/region is wrong.
• Slow first backup: normal; later runs only send changes.

Frequently asked questions

restic or rclone?

rclone copies files; restic keeps versioned, encrypted, deduplicated snapshots. See rclone backups.

Can restic use Object Lock buckets?

It works with versioned and locked buckets with some care around pruning; see immutable backups.

Is the data encrypted at the provider?

Yes, restic encrypts before upload; the provider never sees plaintext.

Next steps

• Immutable backups with Object Lock
• rclone backups
• Snapshot vs backup vs replication