restic | Zata Docs

restic is a fast, open-source backup program for the command line. It encrypts every backup with your password and stores only changed data, so repeated backups are small. It works with a Zata bucket as an S3 repository.

Tested with restic 0.19.1 on Linux with Zata (Indore) in October 2026.

Before you start

A bucket. See Create a bucket.
An access key from the same region as the bucket. See Access keys.
restic installed (see below).

Install restic

Check first whether restic is installed with restic version. To install it on Linux (x86-64):

Install restic on Linux

curl -L https://github.com/restic/restic/releases/download/v0.19.1/restic_0.19.1_linux_amd64.bz2 | bunzip2 > restic
chmod +x restic
sudo mv restic /usr/local/bin/
restic version

Ubuntu’s apt install restic gives an old version (0.12). For Windows, macOS or ARM Linux, see the restic installation guide.

Connection settings

Setting	Value
`RESTIC_REPOSITORY`	`s3:https://idr01.zata.ai/my-bucket/restic` for Indore, `s3:https://bom01.zata.ai/my-bucket/restic` for Mumbai
`AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY`	From Access Keys in the Zata console. The key must be from the same region as the bucket.
`AWS_DEFAULT_REGION`	`us-east-1`
Path-style	Add `-o s3.bucket-lookup=path` to every restic command

The /restic at the end of the repository is a folder inside your bucket, not a new bucket. restic does not use the AWS SDK, so it needs no checksum or signature settings for Zata.

Set up restic

Set the connection details

Replace my-bucket with your bucket name, and idr01 with bom01 if the bucket is in Mumbai.

export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
export AWS_DEFAULT_REGION=us-east-1
export RESTIC_REPOSITORY="s3:https://idr01.zata.ai/my-bucket/restic"

These export lines last only for the current terminal.

Create the repository password

restic encrypts every backup with this password. This asks for it without showing it, so it never lands in your shell history:

umask 077
read -rsp "Choose a restic repository password: " RESTIC_PASSWORD; echo
printf '%s' "$RESTIC_PASSWORD" > ~/.restic-password
unset RESTIC_PASSWORD
export RESTIC_PASSWORD_FILE=~/.restic-password

Keep a copy of the password somewhere safe. If it is lost, nobody can restore the backups, and Zata cannot recover it.

Create the repository (once)

restic -o s3.bucket-lookup=path init

Back up

restic -o s3.bucket-lookup=path backup ~/documents

Test it

List the snapshots, restore the latest one to a separate folder, and check the repository:

restic -o s3.bucket-lookup=path snapshots
restic -o s3.bucket-lookup=path restore latest --target ~/restore
restic -o s3.bucket-lookup=path check

Open a few restored files to confirm they are complete.

Remove old snapshots

restic keeps every snapshot until you remove it. This keeps the last 7 daily and 4 weekly snapshots and deletes the data no longer needed:

restic -o s3.bucket-lookup=path forget --keep-daily 7 --keep-weekly 4 --prune

Run it on a schedule

For scheduled backups (cron), put the settings in a script that only you can read:

~/restic-backup.sh

#!/bin/bash
export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
export AWS_DEFAULT_REGION=us-east-1
export RESTIC_REPOSITORY="s3:https://idr01.zata.ai/my-bucket/restic"
export RESTIC_PASSWORD_FILE="$HOME/.restic-password"
restic -o s3.bucket-lookup=path backup "$HOME/documents"

Make it private and executable:

chmod 700 ~/restic-backup.sh

Then run crontab -e and add this line to run it every night at 02:00:

crontab

0 2 * * * $HOME/restic-backup.sh >> $HOME/restic-backup.log 2>&1

Troubleshooting

Problem	Fix
`unable to open config file`	The repository does not exist yet. Run `restic -o s3.bucket-lookup=path init` once.
Access denied or invalid key	Copy the keys again from Access Keys. The key must be from the same region as the endpoint in `RESTIC_REPOSITORY`.
`wrong password or no key found`	Use the exact password you chose at `init`. It cannot be reset.
Repository URL errors	The format is `s3:https://idr01.zata.ai/my-bucket/restic`. Do not write `s3:s3://`.

For other errors, see Signature errors and Endpoint and region.