A complete, automated, and hyper-efficient backup strategy using Restic and resticprofile.

restic backup . --tag "pre-huge-project" --exclude-caches & restic snapshots to view

Failsafe backup setup - Restic

If your current backup strategy involves dragging and dropping folders to an external drive, relying solely on standard cloud sync (which syncs deletions and corruptions instantly) or using basic zip scripts, you're missing out on the magic of modern backups.

Why Restic is best the best at backing up your backups:

  1. Deduplication: Restic breaks your files into chunks and only saves the unique ones. If you rename a 1GB file, move it, or copy it, Restic backs it up instantly without using an extra byte of storage.
  2. True Snapshots: Every time you back up, it creates a point-in-time snapshot. It looks like a full backup, but takes seconds to create and uses almost no extra space.
  3. Encrypted by Default: Your data is encrypted before it ever leaves your computer. No one (not even your cloud provider) can read it without your password.
  4. Fast: It is blazingly fast because it relies on metadata to detect changes and skips reading unmodified files entirely.

Our Implementation Guide

Here is exactly how this repository (archAive) is set up, so you can replicate it for your own workflow.

1. Store Credentials Securely

Create a .env file in the root of the directory to hold the repository location and password. This prevents hardcoding passwords in scripts.

export RESTIC_REPOSITORY=/path/to/your/backup/destination
export RESTIC_PASSWORD='your_super_secret_password'

2. Smart Exclusions (CACHEDIR.TAG)

Backing up cache folders (like node_modules or .tmp) wastes massive amounts of space. Restic respects the "Cache Directory Tagging Standard".

To exclude a folder, simply create a file named CACHEDIR.TAG inside it, with this exact signature:

Signature: 8a477f597d28d172789f06886806bc55

Restic will now completely ignore the contents of any folder containing this tag when you use the --exclude-caches flag.

Where do you get the signature from?

It comes directly from the Cache Directory Tagging Standard created by Bryan Ford. It's an industry standard used by backup tools (like Restic, tar, etc.). Backup tools look for that exact hash to confirm that the file is genuinely an intentional cache tag and not just a random file you happened to name CACHEDIR.TAG

3. Automating with resticprofile

Writing bash scripts with cron can get messy. We use a tool called resticprofile to orchestrate everything natively.

Create a file named profiles.yaml in your root folder:

version: "1"

global:
  restic-lock-retry-after: 1m
  restic-stale-lock-age: 2h

default:
  # Automatically load the .env file
  env:
    - ".env"

  backup:
    source:
      - "/Users/healmiy/archAive"
    skip-if-unchanged: true
    exclude-caches: true
    tag:
      - "daily"
      - "archAive"

  retention:
    # Run the forget & prune policy automatically after each backup
    before-backup: false
    after-backup: true
    keep-daily: 7
    keep-weekly: 4
    keep-monthly: 6
    prune: true
    
  # Schedule it to run daily at 2:00 PM (14:00)
  schedule: "14:00"
  schedule-permission: "user"
Do I type profiles.yaml backup in the terminal? (why not restic specific name.yaml?)

profiles.yaml is the exact default filename that resticprofile looks for automatically. As long as you are inside the folder, you just type resticprofile backup and it silently finds and reads the file.
You absolutely can rename it, but resticprofile won't find it automatically anymore. You just have to explicitly point to it using the -c flag. For example: resticprofile -c resticBackingUp.yaml backup or resticprofile -c resticBackingUp.yaml schedule.

Cheat Sheet: Commands You Will Definitely Forget

Because resticprofile handles the heavy lifting, your daily interaction is minimal. But here are the vital commands for maintenance and manual overrides:

Running Backups:

If I'm about to undertake a huge project, what command can I input manually to make a save point?

If you're about to do something massive or destructive, it's highly recommended to make a "Named Save Point." Instead of just running the standard profile, use raw restic to inject a custom tag on the fly so you can easily spot it if you need to restore:

source .env
restic backup . --tag "pre-huge-project" --exclude-caches

Later, running restic snapshots will show this specific backup tagged clearly as "pre-huge-project"

Automation (macOS / Linux):

Maintenance (Native Restic Commands):
Even with automation, you should occasionally run maintenance checks.

Enter your search text in the box above

Select a result to preview