Skip to main content

restic

restic is a modern backup tool with content-defined chunking, deduplication, and client-side encryption. It targets any S3-compatible bucket as a repository.

Install​

PlatformCommand
macOSbrew install restic
Debian/Ubuntusudo apt install restic
Linux (other)Download a binary from restic.net

Initialize a repository​

export AWS_ACCESS_KEY_ID="YOUR_FILEBASE_KEY"
export AWS_SECRET_ACCESS_KEY="YOUR_FILEBASE_SECRET"
export RESTIC_PASSWORD="<a-strong-password>"

restic -r s3:https://s3.filebase.io/my-restic-bucket init

You'll be prompted to set a repository password — lose this and your backups are unrecoverable, restic encrypts everything client-side. Save it in a password manager.

Back up​

restic -r s3:https://s3.filebase.io/my-restic-bucket backup ~/Documents

restic prints throughput, deduplication ratio, and a snapshot ID. Run the same command later and only changed/new chunks upload — restic deduplicates aggressively.

List snapshots​

restic -r s3:https://s3.filebase.io/my-restic-bucket snapshots

Restore​

restic -r s3:https://s3.filebase.io/my-restic-bucket restore latest --target ./restored

Replace latest with a specific snapshot ID to restore a different point-in-time.

Forget old snapshots​

restic -r s3:https://s3.filebase.io/my-restic-bucket forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 12 \
  --prune

Automated backups​

A simple cron job:

/etc/cron.d/restic-backup
0 3 * * * root /usr/local/bin/restic-backup.sh
/usr/local/bin/restic-backup.sh
#!/bin/bash
set -euo pipefail

export AWS_ACCESS_KEY_ID="..."
export AWS_SECRET_ACCESS_KEY="..."
export RESTIC_PASSWORD_FILE="/etc/restic.pass"

restic -r s3:https://s3.filebase.io/my-restic-bucket \
  backup --tag nightly /home /etc

restic -r s3:https://s3.filebase.io/my-restic-bucket \
  forget --tag nightly --keep-daily 7 --keep-weekly 4 --prune

Make sure /etc/restic.pass is chmod 600.

Why restic + Filebase is a great pairing​

  • Free egress means cheap restores; no surprise bandwidth bill on a disaster recovery.
  • Deduplication means storage stays small even with frequent snapshots.
  • Client-side encryption means Filebase never sees your plaintext.

What's next​