Initialize a restic repository

restic stores encrypted, deduplicated snapshots in a repository. That’s a directory structure restic fully controls, on a local disk, an SSH server, or object storage like S3. Everything is encrypted before it leaves your machine, so the storage provider never sees your data. You need the repository password to recover its keys and data.

Encryption plus versioning is what separates restic from plain tar and rsync copies. You get history, and you don’t need to trust the destination.

Create a practice repository

Let’s initialize a disposable local repository:

mkdir restic-lab
export RESTIC_REPOSITORY=$PWD/restic-lab
restic init

restic asks for a new password, then confirms:

created restic repository 3f8a91c2d4 at /home/flavio/restic-lab
Please note that knowledge of your password is required to access
the repository. Losing your password means that your data is
irrecoverably lost.

That warning is literal. We’ll come back to it.

The RESTIC_REPOSITORY environment variable saves you from typing -r /path on every command. For scripts, add RESTIC_PASSWORD_FILE pointing at a root-readable file. The password then never appears on the command line or in your shell history:

export RESTIC_PASSWORD_FILE=$HOME/.config/restic/lab-password

Verify it opens

Store the password in a protected place for the lab. Then confirm the empty repository opens:

restic snapshots

repository 3f8a91c2 opened (version 2)

An empty snapshot list with no error is exactly right. You proved the password works before trusting the repository with data.

Peek inside restic-lab/ too. You’ll see config, keys/, and data/ full of opaque encrypted files. Nothing in there is readable without the password. That’s the point.

The unforgiving part

If you lose the password and the key material, encryption works against you. There is no recovery mechanism, no support ticket, no brute-force shortcut. A perfectly intact repository becomes permanent noise.

So plan for this before the first real backup. Store the password in a password manager. Keep a second copy somewhere that doesn’t die with your laptop. A backup you can’t decrypt is the same as no backup.