Step 1: Install Restic

sudo apt update
sudo apt install restic -y
restic version

Step 2: Set the environment variables for S3

sudo nano /etc/restic-env

Add:

export AWS_ACCESS_KEY_ID="YOUR_ACCESS_KEY"
export AWS_SECRET_ACCESS_KEY="YOUR_SECRET_KEY"
export RESTIC_REPOSITORY="s3:https://s3.amazonaws.com/your-bucket-name"
export RESTIC_PASSWORD="a-very-strong-password"

For Backblaze B2 or Wasabi, use their specific endpoint (e.g., s3:https://s3.eu-central-003.backblazeb2.com/your-bucket).

Restrict the file permissions:

sudo chmod 600 /etc/restic-env

Step 3: Initialize the backup repository

source /etc/restic-env
restic init

Restic will create an empty, encrypted repository in the S3 bucket.

Step 4: Run the first manual backup

restic backup /var/www /etc --exclude="*.log" --exclude="*.tmp"

On subsequent runs, Restic will only process new/changed files (incremental backup via block-level deduplication).

Step 5: Check existing snapshots

restic snapshots

Step 6: Create an automated backup script

sudo nano /usr/local/bin/backup-restic.sh

Content:

#!/bin/bash
source /etc/restic-env

restic backup /var/www /etc /home \
  --exclude="*.log" --exclude="*.tmp" \
  --tag automated

# Remove snapshots older than 30 days, keeping at least 7 daily and 4 weekly
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

# Verify repository integrity
restic check

Make the script executable:

sudo chmod +x /usr/local/bin/backup-restic.sh

Step 7: Schedule the automated backup with cron

sudo crontab -e

Add a line to run it daily at 2:00 AM:

0 2 * * * /usr/local/bin/backup-restic.sh >> /var/log/restic-backup.log 2>&1

Step 8: Test restoring a file

source /etc/restic-env
restic restore latest --target /tmp/restore-test --include /etc/nginx

Check /tmp/restore-test to confirm the files were restored correctly.

Additional recommendations

• Store RESTIC_PASSWORD in a separate password manager — if you lose it, the backups become unrecoverable (end-to-end encryption)
• Add an email/Slack alert to the backup script if restic check fails
• For Windows servers, Restic has a native binary and can be scheduled with Task Scheduler instead of cron.