Initialize a restic repository

restic stores encrypted, deduplicated snapshots in a repository — a directory structure it fully controls, on a local disk, an SSH server, or object storage like S3. Everything inside is encrypted before it leaves your machine, so the storage provider never sees your data. The repository password is required to recover its keys and data.

Encryption plus versioning is what separates restic from plain tar and rsync copies: you get history, and the destination doesn’t need to be trusted.

Create a practice repository

Initialize a disposable local repository:

mkdir restic-lab
export RESTIC_REPOSITORY=$PWD/restic-lab
restic init

restic prompts for a new password, then confirms:

created restic repository 3f8a91c2d4 at /home/flavio/restic-lab
Please note that knowledge of your password is required to access
the repository. Losing your password means that your data is
irrecoverably lost.

That warning is literal, and we’ll come back to it.

The RESTIC_REPOSITORY environment variable saves you from repeating -r /path on every command. For scripts, add RESTIC_PASSWORD_FILE pointing at a root-readable file, so the password never appears in the command line or shell history:

export RESTIC_PASSWORD_FILE=$HOME/.config/restic/lab-password

Verify it opens

Record the password in a protected temporary lab location, then use restic snapshots to confirm the empty repository opens:

restic snapshots

repository 3f8a91c2 opened (version 2)

An empty snapshot list with no error is exactly right. You’ve proven the password works before trusting the repository with data. Peek inside restic-lab/ too: you’ll see config, keys/, and data/ directories full of opaque encrypted files. Nothing in there is readable without the password — that’s the point.

The unforgiving part

If the password and key material are lost, encryption works against you too. There is no recovery mechanism, no support ticket, no brute-force shortcut. A perfectly intact repository becomes permanent noise.

So plan protected recovery before real backups: store the password in a password manager, and keep a second copy somewhere that survives the same disaster as your laptop. A backup you can’t unlock is indistinguishable from no backup.