Exclude disposable and secret inputs

Not everything in a directory deserves backing up. A JavaScript project might be 50 MB of your code and 800 MB of node_modules that npm install rebuilds in a minute. Backing up the rebuildable part wastes time, storage, and — worse — buries the data you actually care about.

Exclusions reduce time and storage, but a broad pattern can silently omit critical data. Review what is selected before relying on the result.

Write an exclusion file

Create an exclusion file with one pattern per line:

node_modules/
.cache/
*.tmp

# use with:
# restic backup --exclude-file exclusions.txt project/

Each pattern matches anywhere in the tree, so node_modules/ catches every nested copy across all your projects. The same file format works over time: you refine it as you discover new cache directories, and every scheduled backup picks up the changes.

Verify what gets selected

Never trust an exclusion pattern you haven’t watched work. Run with --dry-run --verbose and inspect included and excluded paths:

restic backup --exclude-file exclusions.txt --dry-run --verbose project/

The verbose output prints a line per file. Scan it for two things: rebuildable junk that slipped through, and — much more important — real data that got excluded by an overly greedy pattern. A pattern like *.tmp looks harmless until you meet an application that stores permanent data in files named that way.

Then restore a sample before finalizing the pattern. The dry run shows what restic plans to store; a test restore proves the data you care about is really in the snapshot.

Disposable versus secret

Do not exclude a directory merely because it is large. Decide whether it is reproducible and document how. “We don’t back up node_modules because npm ci rebuilds it from the committed lockfile” is a decision. “It was big so I skipped it” is a future incident.

Secrets need the same deliberate treatment in the other direction. Files like .env are tiny, unique, and often the one thing you can’t recreate after a disaster. Inside an encrypted restic repository they’re reasonably protected, so my advice is to include them — unless the repository is shared with people who shouldn’t hold production credentials. Either way, make it a written decision, not an accident of a glob pattern.