3-2-1 homelab backups with restic, in practice

Every “safe update” plan assumes you have a backup. restic is a fast, encrypted, deduplicating backup tool that’s well suited to homelabs.

The 3-2-1 rule

• 3 copies of your data (the live copy + 2 backups)
• 2 different storage media (e.g. local disk/NAS and cloud object storage)
• 1 copy offsite

Set up a repository

restic repos can live on local disk, SFTP, or S3-compatible storage (see working with repositories).

export RESTIC_REPOSITORY=/mnt/nas/restic
export RESTIC_PASSWORD_FILE=/root/.restic-pass
restic init

Store the password somewhere besides the server. Without it the repository can’t be decrypted. Not by you, not by anyone.

Back up the right things

Back up Compose files, .env files, bind-mounted data, and database dumps (not the live DB files):

docker compose -f ~/stacks/immich/compose.yaml exec -T database \
  pg_dumpall -U postgres > ~/backups/immich-db.sql
restic backup ~/stacks ~/backups

Keep a sensible history

Use forget with --prune to apply a retention policy:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
restic check

Add the offsite copy

Run a second repository on S3-compatible storage (or a friend’s box over SFTP) with the same commands and a different RESTIC_REPOSITORY.

Test a restore

restic restore latest --target /tmp/restore-test

See restoring. Actually bring up a stack from the restored data once. Until you’ve done that, you don’t know the backup works.

Checklist

• Local repo + offsite repo
• Password stored off the server
• DB dumps included
• Retention + restic check scheduled
• Restore tested