How to Back Up Servers to the Cloud With restic and Immutable Storage (3-2-1-1-0)

Step by step

1. Create an immutable bucket

   Enable versioning and object lock (compliance or governance mode) with a retention of, for example, 30 days, so nobody can delete backups early, not even an attacker with your keys.

2. Create a limited access key

   The backup key may write and read, but not change bucket settings or delete locked objects.

3. Initialise the repository

   restic encrypts everything on the client before upload. Store the repository password in your password manager.

   export AWS_ACCESS_KEY_ID=... AWS_SECRET_ACCESS_KEY=...
   export RESTIC_REPOSITORY=s3:https://s3.eu-central-1.amazonaws.com/corp-backups/srv01
   export RESTIC_PASSWORD_FILE=/root/.restic-pass
   restic init
   

4. Run the backup

   Back up data folders and exclude caches.

   restic backup /etc /srv /var/lib/app --exclude-caches
   

5. Schedule and keep a retention policy

   Run nightly with a systemd timer or cron, then thin out old snapshots.

   restic forget --keep-daily 14 --keep-weekly 8 --keep-monthly 12 --prune
   

6. Verify

   Check the repository and read part of the data back every week.

   restic check --read-data-subset=5%
   

7. Test a real restore

   Every month restore a folder or a whole server to a test machine and confirm the application works. A backup you never restored is not a backup.

Commands are generic, industry-standard examples. Exact syntax and menu names vary by model and firmware; check your device's manual on the Documentation page.