restic — Encrypted, Deduplicated Backups to EU S3

Fast, encrypted, deduplicated backups from the command line. Works on Linux and macOS. Windows is supported via the restic binary with PowerShell environment variables and Task Scheduler — not covered here.

1. Install restic

On Debian/Ubuntu:

sudo apt install restic

On macOS:

brew install restic

The apt package may lag behind upstream releases. For the latest version, download the static binary from github.com/restic/restic/releases and place it in /usr/local/bin.

2. Get your S3 credentials

Log in to your HummingTribe dashboard → S3 Storage tab. Copy your Access Key ID and reveal your Secret Access Key (shown once — save it now).

3. Export environment variables

restic reads its configuration from environment variables. Set these in your terminal:

export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
export RESTIC_REPOSITORY="s3:https://storage.hummingtribe.com/your-bucket-name"
export RESTIC_PASSWORD="your-password"

RESTIC_PASSWORD is the encryption passphrase for your repository. Choose a strong password and store it securely. If you lose this password, your backups are unrecoverable — restic has no password reset.

4. Initialize the repository

restic init

This creates the repository structure in your S3 bucket and derives an encryption key from RESTIC_PASSWORD. You only need to run this once per bucket.

5. Run your first backup

restic backup /path/to/data

Example output:

repository 3a9e2b1c opened (version 2, compression level auto)
created new cache in /home/user/.cache/restic

Files:        142 new,     0 changed,     0 unmodified
Dirs:          18 new,     0 changed,     0 unmodified
Added to the repository: 48.271 MiB (45.893 MiB stored)

processed 142 files, 48.271 MiB in 0:03
snapshot 6a3e8f12 saved

Subsequent backups only upload changed or new data blocks — restic deduplicates automatically.

6. List snapshots and restore

List all snapshots:

restic snapshots

Restore a specific snapshot to a target directory:

restic restore 6a3e8f12 --target /path/to/restore

Replace 6a3e8f12 with the snapshot ID from restic snapshots.

7. Automate with cron or launchd

Store your environment variables in a file so cron or launchd can source them.

Create /root/.restic.env (Linux) or ~/.restic.env (macOS):

export AWS_ACCESS_KEY_ID="your-access-key-id"
export AWS_SECRET_ACCESS_KEY="your-secret-access-key"
export RESTIC_REPOSITORY="s3:https://storage.hummingtribe.com/your-bucket-name"
export RESTIC_PASSWORD="your-password"

Lock down permissions — this file contains your repo password and S3 credentials in plaintext:

chmod 600 ~/.restic.env

Linux (cron): Create /etc/cron.d/restic-backup:

0 2 * * * root . /root/.restic.env && /usr/bin/restic backup /path/to/data --quiet

macOS (launchd): Create ~/Library/LaunchAgents/com.user.restic.plist:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN"
  "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
  <key>Label</key>
  <string>com.user.restic</string>
  <key>ProgramArguments</key>
  <array>
    <string>/bin/bash</string>
    <string>-c</string>
    <string>source $HOME/.restic.env &amp;&amp; /usr/local/bin/restic backup /path/to/data --quiet</string>
  </array>
  <key>StartCalendarInterval</key>
  <dict>
    <key>Hour</key>
    <integer>2</integer>
    <key>Minute</key>
    <integer>0</integer>
  </dict>
</dict>
</plist>

Load the agent:

launchctl load ~/Library/LaunchAgents/com.user.restic.plist

8. Retention policy with forget + prune

Remove old snapshots by policy:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

forget removes snapshots that fall outside the retention rules. prune deletes unreferenced data blocks and frees the actual storage. Pruning is an expensive operation on large repositories — schedule it separately from the nightly backup (e.g. weekly on Sundays).

Manage your bucket and credentials from your HummingTribe dashboard.