Automating Scheduled Server Backups with Restic and Systemd Timers

Why Modern Backups Need Deduplication and Encryption

Traditional tar.gz backups consume excessive storage and lack encryption. Restic divides files into cryptographic content-addressed chunks, ensuring that files duplicated across snapshots take up zero extra space while remaining protected by AES-256 encryption.

Step 1: Install Restic

Install Restic from the Ubuntu repository:

sudo apt update && sudo apt install -y restic

Step 2: Initialize an Encrypted Repository

Initialize a backup repository on an external drive or backup partition:

export RESTIC_REPOSITORY="/mnt/backups/restic-repo"
export RESTIC_PASSWORD="YourStrongSecurePasswordHere"
restic init

Step 3: Creating the Backup Script

Create a backup script at /usr/local/bin/backup-server.sh with restricted permissions:

#!/usr/bin/env bash
set -euo pipefail

export RESTIC_REPOSITORY="/mnt/backups/restic-repo"
export RESTIC_PASSWORD_FILE="/etc/restic-password"

# Run backup
restic backup \
  --exclude="/var/cache" \
  --exclude="/var/tmp" \
  /etc /var/www /home

# Prune old snapshots (keep 7 daily, 4 weekly, 6 monthly)
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

sudo chmod 700 /usr/local/bin/backup-server.sh

Step 4: Creating the Systemd Timer

Create the service unit at /etc/systemd/system/restic-backup.service:

[Unit]
Description=Restic Daily Backup Service

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup-server.sh

Create the accompanying timer at /etc/systemd/system/restic-backup.timer:

[Unit]
Description=Run Restic Backup Daily at 03:00

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable --now restic-backup.timer
sudo systemctl list-timers

Your server will now execute automated encrypted backups every morning with automated retention management.