Restic backups that I actually test

Every machine gets the same three pieces: a restic repository on a remote box, a systemd timer that runs the backup at night, and a calendar reminder to restore something once a month.

restic -r sftp:backup@nas:/srv/restic/$(hostname) backup /etc /home /srv \
  --exclude-caches --one-file-system
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

The restore drill is the important part. I pick a random file, restore it to /tmp and diff it against the live copy. It takes five minutes and has caught two broken repositories so far.

Things I learned the hard way: keep the repository password somewhere that is not on the machine being backed up, and run restic check --read-data-subset=5% weekly.