How To Set Up Restic For Encrypted, Deduplicated Backups

Proxmox Backup Server () handles VM-level backups well, but plenty of homelab data lives outside any VM entirely — configuration files, documents, or application data you’d rather back up directly rather than through a full VM snapshot. Restic encrypted backups fill that gap, offering fast, deduplicated, and encrypted backups for exactly this kind of file-level data.

What Is Restic?

Restic is a free, open-source backup tool designed around three core properties: encryption by default (your backups are unreadable without the encryption key, even to whoever controls the storage location), deduplication (identical data blocks are only stored once, even across multiple backup runs), and support for a wide range of storage backends — local disks, SFTP servers, and numerous cloud storage providers.

Why Restic Complements Rather Than Replaces PBS

Proxmox Backup Server excels specifically at VM and container-level backups within a Proxmox environment. Restic operates at the file level, making it well suited for backing up configuration directories, application data outside VMs, or for creating an additional off-site backup layer (tying directly into the 3-2-1 backup rule ) using cloud storage that PBS doesn’t natively target.

Installing Restic

sudo apt install restic -y

Initializing a Backup Repository

Before your first backup, initialize a repository at your chosen storage location:

restic init --repo /mnt/backup-drive/restic-repo

You’ll be prompted to set a repository password — this encrypts everything stored, and losing it means losing access to your backups entirely, so store it securely (a password manager is strongly recommended).

Running Your First Backup

restic backup /etc /home/user/important-data --repo /mnt/backup-drive/restic-repo

Restic scans the specified paths, uploading only new or changed data blocks compared to any previous backup in the repository.

Using Environment Variables to Avoid Repeated Prompts

Rather than typing the repository path and password on every command, set them as environment variables:

export RESTIC_REPOSITORY="/mnt/backup-drive/restic-repo"
export RESTIC_PASSWORD="your-repository-password"

Backing Up to Cloud Storage

Restic supports numerous cloud backends directly, useful specifically for the off-site component of a 3-2-1 backup strategy:

export RESTIC_REPOSITORY="s3:https://s3.amazonaws.com/your-bucket-name"
export AWS_ACCESS_KEY_ID="your-key"
export AWS_SECRET_ACCESS_KEY="your-secret"
restic init

Similar configuration patterns work for other supported backends, including Backblaze B2, which is popular in the homelab community for its low storage costs.

Understanding Deduplication Benefits

Because Restic deduplicates at the block level rather than the whole-file level, even large files that change only slightly between backups (a growing log file, for instance) only need to store the actual changed portions on subsequent backups, keeping repository growth much slower than naive full-copy backup approaches.

Listing and Browsing Snapshots

restic snapshots

This shows every backup run stored in the repository, each identified by a unique snapshot ID and timestamp.

Restoring from a Backup

restic restore latest --target /tmp/restore-test

Or restore a specific historical snapshot by its ID:

restic restore abc1234 --target /tmp/restore-test

Pruning Old Snapshots

To avoid unlimited repository growth, configure retention policies and periodically prune old snapshots beyond what you actually need to keep:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

This keeps the most recent 7 daily, 4 weekly, and 6 monthly snapshots, removing anything older and reclaiming the storage space no longer referenced by any retained snapshot.

Automating with Cron

Schedule regular backups combined with the bash scripting techniques :

bash

#!/bin/bash
export RESTIC_REPOSITORY="/mnt/backup-drive/restic-repo"
export RESTIC_PASSWORD="your-repository-password"

restic backup /etc /home/user/important-data
restic forget --keep-daily 7 --keep-weekly 4 --prune

Schedule this script via cron for fully automated, ongoing file-level backups.

Verifying Backup Integrity

Periodically check that a repository’s stored data hasn’t become corrupted:

restic check

Final Thoughts

Setting up Restic encrypted backups rounds out a homelab backup strategy by covering file-level data that VM-focused tools like Proxmox Backup Server don’t directly address, with the added benefits of encryption, deduplication, and flexible cloud storage support ideal for the off-site component of a proper 3-2-1 backup approach. Combined with PBS for VM-level protection, Restic ensures nothing — whether it lives inside a VM or directly on the host — falls outside your overall backup coverage.

How to Set Up Restic for Encrypted, Deduplicated Backups