What is restic?
restic is a backup program that is fast, efficient and secure. It splits your files into content-defined chunks and stores each chunk once, so a second backup of a mostly unchanged directory transfers almost nothing. Everything is encrypted and authenticated on your machine, with AES-256 and Poly1305-AES, before a single byte leaves it, which means the repository can live somewhere you do not fully trust. Snapshots are append-only and can be listed, diffed, mounted as a filesystem and restored file by file, with one command each and no configuration file to write.
check fixes, memory reductions on large repositories and new backend support actually land. Debian's stable version is frozen years behind: a repository written by a current restic can be unreadable by an old one, so the machine that restores has to be at least as new as the machine that backed up. Running the current release everywhere is the simplest way to keep that true.
⚡ Key Features of restic
🧩 Deduplication That Actually Works
Content-defined chunking means an unchanged file, a moved file and a file that exists on ten machines are all stored once. Daily snapshots of the same tree cost the difference, not the whole tree.
🔐 Encrypted Before It Leaves
AES-256 for contents and Poly1305-AES for authentication, done on the client. The repository holds no plaintext and no unauthenticated data, so hostile storage can lose your backup but not read or forge it.
☁️ Backends for Everywhere
A local directory, SFTP, the REST server, Amazon S3 and everything S3-compatible, OpenStack Swift, Backblaze B2, Azure Blob Storage, Google Cloud Storage, and anything else through rclone.
📸 Snapshots You Can Browse
restic snapshots lists them, restic diff shows what changed between two, and restic mount puts every snapshot under a directory so you can restore a single file with cp.
🧹 Retention and Pruning
forget --keep-daily/--keep-weekly/--keep-monthly expresses a retention policy directly, and --prune reclaims the space in the repository afterwards.
🔎 Verifiable Repositories
restic check validates the repository's structure, and --read-data re-reads and re-verifies every pack file, so "the backup exists" and "the backup is intact" are two questions you can actually answer.
apt upgrade keeps you on the latest version.
📦 Installation from deb.griffo.io
Step 1: Add Repository
sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
sudo apt updateinstall -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
apt updatesudo apt install extrepo
sudo extrepo enable griffo
sudo apt update🆓 There is an always-free mirror. deb-free.griffo.io serves packages free forever, no account, no subscription, at most 2 months behind upstream, security fixes immediately. It currently carries cliamp, Ghostty, lazydocker, Oh My Posh and Zed; restic is not one of them, so the repository above is the only way to get it today, ask and it can be enrolled.
🧩 About the extrepo option. extrepo is Debian's own tool for external repositories: it writes the sources file and installs the signing key for you, checking the key against signed metadata first. This repository is registered with it as griffo, and the always-free mirror as griffo-free, so on Debian (bookworm, trixie, forky and sid) the commands above are the whole setup.
extrepo sets up the sources file and the key only, so a subscription's credentials still go in /etc/apt/auth.conf.d/deb.griffo.io.conf. Ubuntu is not covered, because extrepo publishes metadata for Debian suites only: there, use the sudo or root commands.
Step 2: Install restic
# Install latest restic
sudo apt install restic
# Verify installation
restic version# Install latest restic
apt install restic
# Verify installation
restic versionStep 3: Create your first repository
# A repository is a directory, local or remote. Pick a password and keep it:
# without it the data is gone, and there is no recovery path by design.
restic init --repo /srv/backup/restic
# Back something up
restic -r /srv/backup/restic backup ~/Documents
# See what you have
restic -r /srv/backup/restic snapshots
# The manual pages and bash, fish and zsh completions ship with the package
man restic🎯 Basic Usage Examples
Backing up:
# Keep the password in a file instead of typing it into every command
echo 'a long passphrase' | sudo tee /etc/restic-password > /dev/null
sudo chmod 600 /etc/restic-password
export RESTIC_REPOSITORY=/srv/backup/restic
export RESTIC_PASSWORD_FILE=/etc/restic-password
# Back up several paths, skipping what a restore would not want
restic backup ~/Documents ~/Pictures --exclude '**/node_modules' --exclude '*.iso'
# Or drive it from a file, one pattern per line
restic backup ~ --exclude-file ~/.config/restic-excludes --exclude-caches
# Tag a snapshot so you can find it later
restic backup /etc --tag config --tag "$(hostname)"# Keep the password in a file instead of typing it into every command
echo 'a long passphrase' | tee /etc/restic-password > /dev/null
chmod 600 /etc/restic-password
export RESTIC_REPOSITORY=/srv/backup/restic
export RESTIC_PASSWORD_FILE=/etc/restic-password
# Back up several paths, skipping what a restore would not want
restic backup ~/Documents ~/Pictures --exclude '**/node_modules' --exclude '*.iso'
# Or drive it from a file, one pattern per line
restic backup ~ --exclude-file ~/.config/restic-excludes --exclude-caches
# Tag a snapshot so you can find it later
restic backup /etc --tag config --tag "$(hostname)"Restoring and browsing:
# What is in the repository
restic snapshots
restic ls latest /etc
# Restore everything from the newest snapshot
restic restore latest --target /tmp/restore
# Or just the paths you actually lost
restic restore latest --target / --include /etc/nginx
# Mount the whole history and copy a file out by hand (FUSE required)
sudo apt install fuse3
mkdir -p ~/mnt/backup
restic mount ~/mnt/backup
# What changed between two snapshots
restic diff 1a2b3c4d 5e6f7a8b# What is in the repository
restic snapshots
restic ls latest /etc
# Restore everything from the newest snapshot
restic restore latest --target /tmp/restore
# Or just the paths you actually lost
restic restore latest --target / --include /etc/nginx
# Mount the whole history and copy a file out by hand (FUSE required)
apt install fuse3
mkdir -p ~/mnt/backup
restic mount ~/mnt/backup
# What changed between two snapshots
restic diff 1a2b3c4d 5e6f7a8bRemote repositories:
# SFTP: any box you can already ssh into
restic -r sftp:backup@nas:/srv/restic init
# S3 and everything S3-compatible, including self-hosted Garage or MinIO
export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...
restic -r s3:https://s3.example.com/backups init
# Backblaze B2
export B2_ACCOUNT_ID=... B2_ACCOUNT_KEY=...
restic -r b2:my-bucket:backups init
# Anything rclone reaches, which is everything else
restic -r rclone:mydrive:backups initRetention, pruning and verification:
# A retention policy, applied to the whole repository
restic forget --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --prune
# Dry run first, because forget deletes snapshots
restic forget --keep-daily 7 --dry-run
# Structure check, cheap, run it often
restic check
# Re-read and re-verify a sample of the actual data, expensive, run it monthly
restic check --read-data-subset 10%
# Where is the space going
restic stats --mode raw-data🔧 Tool Integrations
restic is designed to be driven by the things you already run:
- systemd: a service plus a timer is the usual unattended setup;
RESTIC_REPOSITORYandRESTIC_PASSWORD_FILEgo in the unit, not in a shell profile - rclone: the
rclone:backend gives restic every provider rclone supports, without restic needing to speak any of them - FUSE:
fuse3(orfuse) turnsrestic mountinto a browsable directory of every snapshot, which is the fastest way to recover one file - rest-server: upstream's own HTTP backend, with append-only mode, so a compromised client cannot delete the backups it made
- Databases:
--stdintakes a dump on standard input, sopg_dump … | restic backup --stdin --stdin-filename db.sqlnever touches the disk
🚀 Why Choose deb.griffo.io?
- Official Debian: ships restic, but the version frozen into the current stable release is well behind upstream, and Debian 12 is further behind still
- Upstream binary: current, but it is a bzip2-compressed binary you unpack into
/usr/local/binyourself, outside apt, withrestic self-updateto maintain it - Snap: confined, which makes backing up paths outside your home and mounting snapshots more work than they should be
- deb.griffo.io: latest version with automatic updates
- ✅ Same Package, Newer Version: same name, same section, same paths as Debian's own
restic, so it is a drop-in replacement and not a second installation - ✅ Verified Upstream Builds: every binary is checked against upstream's
SHA256SUMS, and that file against the restic release key, before it is packaged - ✅ Automatic Updates: packages updated within hours of upstream releases
- ✅ Complete Package: the official upstream binary, the full set of man pages (
restic.1plus one per subcommand) and bash, fish and zsh completions - ✅ Seven Architectures: amd64, arm64, armhf, i386, ppc64el, s390x and riscv64, so the NAS, the Pi and the mainframe all get the same restic
- ✅ Multi-Distribution: works on Bookworm, Trixie, Forky and Sid
- ✅ Easy Maintenance: standard apt commands for updates
📦 Package Build Repository
The Debian packages are automatically built and maintained in this GitHub repository:
- 💾 restic-debian - Latest release builds
🔗 Related Packages
Also available from deb.griffo.io:
- rclone - The backend that gives restic every remaining provider
- Garage - Self-hosted S3 storage to point a repository at
- Zellij - Multiplexer to keep a long first backup running
- bottom - Watch what a large backup does to the machine
💝 Support This Project
If this repository saves you time and effort, please consider supporting it!