Backups
restic with S3-compatible storage: repository design and restore testing
restic can use S3-compatible storage as a backend while encrypting repository contents client-side. That makes the S3 credential and the restic repository password different pieces of the recovery path, and both need deliberate handling.
Separate the S3 key from the repository password
The S3 credential authorizes access to the bucket. The restic password protects the encrypted repository. Losing either can block recovery; leaking the S3 key does not automatically reveal plaintext if restic encryption remains intact.
Store the two secrets through a recoverable secret-management process and keep them out of unprotected scripts.
Use a dedicated bucket or project
Give the repository an isolated storage boundary and a credential that cannot enumerate unrelated customer data. This also makes quota and usage reconciliation easier to reason about.
Avoid reusing a shared administrator key across many backup hosts simply to simplify configuration.
Watch repository growth
Retention and deduplication affect how quickly restic consumes storage, but backend byte counts remain the authoritative capacity limit. Alert before the hard quota is close enough to interrupt a backup.
After large prune operations, allow for provider accounting delay before assuming all capacity has been reclaimed.
Run check and restore workflows
Use restic’s repository checking features as one signal, then perform actual restores of representative files to a separate location. Validate file contents and application usability where appropriate.
A repository that can list snapshots but cannot restore required data has failed the purpose of the backup.
Plan credential rotation without losing repository access
Replace the S3 credential independently from the restic password. Verify the new key can read and write the existing repository before revoking the old one.
Document how to recover the repository if the original backup host is gone, including endpoint, bucket, repository path, S3 key process and restic password recovery. Keep the first restore command and required environment variables in the runbook so a replacement host can be prepared without reconstructing the repository layout from memory.