Exclude disposable and secret inputs

Not everything in a directory deserves a backup. A JavaScript project might be 50 MB of your code and 800 MB of node_modules that npm install rebuilds in a minute. Backing up the rebuildable part wastes time and storage. Worse, it buries the data you care about.

Exclusions fix that. But a broad pattern can silently drop critical data. Always review what gets selected before you rely on the result.

Write an exclusion file

Create a file with one pattern per line:

node_modules/
.cache/
*.tmp

# use with:
# restic backup --exclude-file exclusions.txt project/

Each pattern matches anywhere in the tree. node_modules/ catches every nested copy across all your projects. The file grows with you. You add new cache directories as you discover them, and every scheduled backup picks up the changes.

Verify what gets selected

Never trust an exclusion pattern you haven’t watched work. Run with --dry-run --verbose and read the included and excluded paths:

restic backup --exclude-file exclusions.txt --dry-run --verbose project/

The verbose output prints a line per file. Scan it for two things. Rebuildable junk that slipped through. And, much more important, real data excluded by a greedy pattern. *.tmp looks harmless until you meet an application that stores permanent data in files with that name.

Then restore a sample before you settle on the pattern. The dry run shows what restic plans to store. A test restore proves the data is really in the snapshot.

Disposable versus secret

Don’t exclude a directory just because it’s large. Decide whether it’s reproducible, and write down how. “We don’t back up node_modules because npm ci rebuilds it from the committed lockfile” is a decision. “It was big so I skipped it” is a future incident.

Secrets need the same care in the other direction. Files like .env are tiny, unique, and often the one thing you can’t recreate after a disaster. Inside an encrypted restic repository they’re reasonably protected. My advice is to include them, unless the repository is shared with people who shouldn’t hold production credentials.

Either way, make it a written decision. Not an accident of a glob pattern.