VPS Backup with Restic (Encrypted Backup)

June 2026 · 8 min read

Restic is a backup tool designed for the cloud era — encrypts everything on the client side before uploading, performs deduplication storing only changed blocks (true incremental backup), and can push to S3, MinIO, Backblaze B2, SFTP, or local disk with a single binary. It's ideal for automated VPS backups that demand both security and storage efficiency. This article covers everything from installation to cron setup and retention policies you can use right away.

Install Restic

# Ubuntu / Debian
sudo apt update && sudo apt install -y restic
sudo restic self-update     # Update to latest version

# Check version
restic version

Create a Repository (Backup Destination)

This example uses S3-compatible storage (MinIO/Backblaze) — Restic will prompt you to set a password for repository encryption:

# Set environment variables for S3-compatible
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export RESTIC_REPOSITORY="s3:https://s3.yourdomain.com/backups"
export RESTIC_PASSWORD="a-long-strong-passphrase"

# Initialize repository
restic init

First and Subsequent Backups

# Backup important directories
restic backup /var/www /etc /home --tag manual

# Next time Restic only uploads what changed (incremental automatically)
restic backup /var/www /etc /home --tag daily

# List all snapshots
restic snapshots

Set Up Cron + Retention Policy

Create a script that backs up, then deletes old snapshots by policy, preventing your destination from growing indefinitely:

# /usr/local/bin/restic-backup.sh
#!/bin/bash
export AWS_ACCESS_KEY_ID="your-access-key"
export AWS_SECRET_ACCESS_KEY="your-secret-key"
export RESTIC_REPOSITORY="s3:https://s3.yourdomain.com/backups"
export RESTIC_PASSWORD_FILE="/root/.restic-pass"

restic backup /var/www /etc /home --tag daily
# Keep last 7 days, 4 weeks, 6 months; delete rest + clean up garbage
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

# chmod 700 and add to crontab (2 AM every night)
# 0 2 * * * /usr/local/bin/restic-backup.sh >> /var/log/restic.log 2>&1

Storing backups off the VPS itself is the most important practice — if using Object Storage or a backup VPS, choose a provider with datacenters in Thailand or Singapore for speed during recovery.

Verify Backup is Working Correctly

A backup that "ran successfully" but "cannot be restored" is worthless — you must test restores regularly:

# 1. Check that new snapshots exist
restic snapshots --tag daily

# 2. Verify repository integrity (integrity check)
restic check
restic check --read-data-subset=5%   # Randomly read 5% of actual data

# 3. Test restoring a file to a test directory
restic restore latest --target /tmp/restore-test --include /etc/nginx

# 4. View storage statistics (after dedup)
restic stats latest

Common Issues & Troubleshooting

Error: "repository is already locked"

A previous backup process hung or was killed, leaving the lock file. Unlock only when certain no other backup is running:

restic unlock

Error: "wrong password or no key found"

The RESTIC_PASSWORD doesn't match what was used during repo init. Check that you're using the correct file/variable, with no extra spaces or newlines in the password file:

cat -A /root/.restic-pass   # Must not have $ or trailing spaces

First backup is very slow

The first run must upload all data, so slowness is normal. Subsequent runs are fast because of incremental. Limit upload bandwidth with --limit-upload (KiB/s) to avoid starving your web traffic.

Destination keeps growing despite forget being set

restic forget only removes snapshot references; you need --prune to actually delete data from the repository. Verify your script includes --prune and that it ran successfully.

Frequently Asked Questions

How is Restic different from rsync?

rsync syncs files as direct copies with no encryption and no built-in version history. Restic stores snapshots with multiple versions, full encryption, and dedup, making it better for long-term backup. However, rsync is still faster and simpler for immediate file mirroring.

Where should I store backups?

Follow the 3-2-1 rule: at least 3 copies, on 2 different media/locations, with 1 copy off the main VPS. Options include Object Storage (MinIO/B2/S3) or a second backup VPS in a different datacenter.

Can Restic back up a database?

Yes, but you must dump it to a file first (e.g., mysqldump / pg_dump), then let Restic back up that file — never back up the database's data files directly while it's running, as you may capture an inconsistent snapshot.