Good backups are encrypted, efficient, verifiable, and easy enough that you actually run them - a combination most home-grown scripts miss. restic nails all four. It's a single-binary backup program that encrypts everything client-side, deduplicates data so repeated backups stay small, stores immutable snapshots you can restore from any point, and can verify a repository's integrity. It backs up to local disk, SFTP, S3-compatible object storage, and more.
Snapshots, Encrypted and Deduplicated
The workflow is simple, and every snapshot is encrypted and space-efficient:
# Initialize an encrypted repository
restic -r s3:s3.amazonaws.com/mybucket init
# Back up a directory (a new snapshot)
restic -r s3:...:/mybucket backup /var/www/files
# List snapshots and restore one
restic -r s3:...:/mybucket snapshots
Efficient and Verifiable
Deduplication means the second and subsequent backups only store what changed, so keeping many snapshots stays cheap. And because restic can check a repository's integrity, you get the thing every backup needs and few provide: confidence that a restore will actually work.
Rough Edges and Limitations
- Guard the password. Client-side encryption means losing the repository password means losing the data - there's no recovery.
- Prune to reclaim space. Old snapshots need a retention policy and prune to free storage.
- CLI-first. Scheduling and orchestration are up to you (or a wrapper).
For backups you can trust - encrypted, efficient, and verifiable - restic is one of the best tools available, and it pairs perfectly with rclone's many backends.
Internal link suggestion: link "many storage backends" to the rclone post, which extends restic's reach to even more remotes.