How To Set Up Automated Server Backups With Restic

A server without backups is one bad deploy, one failed disk, or one compromised account away from a very bad day. This tutorial sets up restic, an open-source backup tool with built-in encryption and deduplication, to take automated daily backups of a Linux server and — just as important — to prove those backups can actually be restored.

Step 1 — Install restic

restic ships in Ubuntu 22.04 and 24.04's default repositories, so no third-party repository or manual binary download is required.

sudo apt update
sudo apt install -y restic

Confirm the install:

restic version

Step 2 — Understand repositories and snapshots

restic organizes backups around two concepts. A repository is the encrypted destination your backups go to — it can live on local or mounted disk, a remote SFTP host, or S3-compatible object storage. A snapshot is a single backup run, tied to a point in time. The first snapshot copies all of your data into the repository. Every snapshot after that only stores the data that changed since the previous one — restic deduplicates data across snapshots, so unchanged files (and unchanged parts of changed files) are referenced rather than copied again. Despite storing only the delta, each snapshot is still a complete, independently restorable backup: restic reconstructs the full file tree as it existed at that point by combining new data with references to what was already stored.

Step 3 — Initialize an encrypted repository

Pick a destination physically separate from the server you're backing up — a second disk, a NAS mount, an SFTP host, or an S3-compatible bucket — so that losing the server doesn't also destroy the backups. This tutorial uses a local mounted path as the example. If your destination is a network mount, make sure it's already mounted before proceeding, and that your user has write access to it. restic init creates the final directory in the repository path itself, so you don't need to create /mnt/backups/myserver in advance — you only need /mnt/backups (the mount point) to already exist and be writable by your user.

export RESTIC_REPOSITORY=/mnt/backups/myserver
export RESTIC_PASSWORD=a_strong_passphrase_here

restic init

restic also supports SFTP repositories (using an sftp: prefix on RESTIC_REPOSITORY) and S3-compatible object storage (using an s3: prefix), among other backends. The exact URL format and required credential environment variables differ by backend and provider, so check restic's own documentation for the current syntax rather than guessing — an incorrect repository URL for a remote backend tends to fail in ways that look like a permissions or network problem rather than a syntax one. If you go the SFTP route, restrict the remote account to only the backup directory (an SFTP chroot or restricted shell) rather than giving it general shell access to the remote host.