restic backup

Automated daily restic backup to a Synology NAS over SFTP, driven by a systemd user timer.

What it does

• restic-backup.timer — fires daily (00:00). Persistent=true, so a missed run (machine off) executes on next boot.
• restic-backup.service — oneshot that runs restic backup, then restic forget --prune with a 7 daily / 4 weekly / 6 monthly retention policy.

Backed-up paths

• /home/c/Dokumente/HTB
• /home/c/Dokumente/GitHub
• /home/c/Dokumente/Obsidian Vault
• /home/c/Schreibtisch
• /home/c/Dokumente/Pentesting

Excludes: cache dirs (--exclude-caches), the GOAD workspace/, and *.iso, *.tmp*, *.vmem, *.vmdk.

Repository

• Backend: sftp:home-nas:/FW-COTI (Synology NAS)
• Password: read from ~/.config/restic/password (not in this repo)

Prerequisites (not version-controlled — secrets)

1. restic installed (restic version).

2. SSH host home-nas in ~/.ssh/config, e.g.:

   Host home-nas
       HostName 192.168.1.25
       User c
       IdentityFile ~/.ssh/id_ed25519_restic

3. Password file at ~/.config/restic/password (mode 600).

4. Repository initialized once (only if it doesn't exist yet):

   export RESTIC_REPOSITORY=sftp:home-nas:/FW-COTI
   export RESTIC_PASSWORD_FILE=~/.config/restic/password
   restic init

Install

./install.sh

Copies the units into ~/.config/systemd/user/, enables the timer, and turns on user lingering so backups run even when logged out.

Common commands

export RESTIC_REPOSITORY=sftp:home-nas:/FW-COTI
export RESTIC_PASSWORD_FILE=~/.config/restic/password

systemctl --user start restic-backup.service   # run a backup now
journalctl --user -u restic-backup.service -f   # follow logs
systemctl --user list-timers restic-backup.timer

restic snapshots          # list snapshots
restic check              # verify repo integrity
restic restore latest --target /tmp/restore   # restore latest