> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.zata.prathamchopde.site/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.zata.prathamchopde.site/_mcp/server.

# restic

restic is a fast, open-source backup program for the command line. It encrypts every backup with your password and stores only changed data, so repeated backups are small. It works with a Zata bucket as an S3 repository.

> **Info**
>
> Tested with restic 0.19.1 on Linux with Zata (Indore) in October 2026.

## Before you start

* A bucket. See [Create a bucket](/buckets/create-a-bucket).
* An access key from the same region as the bucket. See [Access keys](/access/access-keys).
* restic installed (see below).

## Install restic

Check first whether restic is installed with `restic version`. To install it on Linux (x86-64):

**`Install restic on Linux`**

```bash Install restic on Linux
curl -L https://github.com/restic/restic/releases/download/v0.19.1/restic_0.19.1_linux_amd64.bz2 | bunzip2 > restic
chmod +x restic
sudo mv restic /usr/local/bin/
restic version
```

Ubuntu's `apt install restic` gives an old version (0.12). For Windows, macOS or ARM Linux, see the [restic installation guide](https://restic.readthedocs.io/en/stable/020_installation.html).

## Connection settings

| Setting                                       | Value                                                                                                          |
| --------------------------------------------- | -------------------------------------------------------------------------------------------------------------- |
| `RESTIC_REPOSITORY`                           | `s3:https://idr01.zata.ai/my-bucket/restic` for Indore, `s3:https://bom01.zata.ai/my-bucket/restic` for Mumbai |
| `AWS_ACCESS_KEY_ID` / `AWS_SECRET_ACCESS_KEY` | From **Access Keys** in the Zata console. The key must be from the same region as the bucket.                  |
| `AWS_DEFAULT_REGION`                          | `us-east-1`                                                                                                    |
| Path-style                                    | Add `-o s3.bucket-lookup=path` to every restic command                                                         |

The `/restic` at the end of the repository is a folder inside your bucket, not a new bucket. restic does not use the AWS SDK, so it needs no checksum or signature settings for Zata.

## Set up restic

#### Set the connection details

Replace `my-bucket` with your bucket name, and `idr01` with `bom01` if the bucket is in Mumbai.

```bash
export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
export AWS_DEFAULT_REGION=us-east-1
export RESTIC_REPOSITORY="s3:https://idr01.zata.ai/my-bucket/restic"
```

These `export` lines last only for the current terminal.

#### Create the repository password

restic encrypts every backup with this password. This asks for it without showing it, so it never lands in your shell history:

```bash
umask 077
read -rsp "Choose a restic repository password: " RESTIC_PASSWORD; echo
printf '%s' "$RESTIC_PASSWORD" > ~/.restic-password
unset RESTIC_PASSWORD
export RESTIC_PASSWORD_FILE=~/.restic-password
```

> **Warning**
>
> Keep a copy of the password somewhere safe. If it is lost, nobody can restore the backups, and Zata cannot recover it.

#### Create the repository (once)

```bash
restic -o s3.bucket-lookup=path init
```

#### Back up

```bash
restic -o s3.bucket-lookup=path backup ~/documents
```

## Test it

List the snapshots, restore the latest one to a separate folder, and check the repository:

```bash
restic -o s3.bucket-lookup=path snapshots
restic -o s3.bucket-lookup=path restore latest --target ~/restore
restic -o s3.bucket-lookup=path check
```

Open a few restored files to confirm they are complete.

## Remove old snapshots

restic keeps every snapshot until you remove it. This keeps the last 7 daily and 4 weekly snapshots and deletes the data no longer needed:

```bash
restic -o s3.bucket-lookup=path forget --keep-daily 7 --keep-weekly 4 --prune
```

## Run it on a schedule

For scheduled backups (cron), put the settings in a script that only you can read:

**`~/restic-backup.sh`**

```bash ~/restic-backup.sh
#!/bin/bash
export AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY
export AWS_SECRET_ACCESS_KEY=YOUR_SECRET_KEY
export AWS_DEFAULT_REGION=us-east-1
export RESTIC_REPOSITORY="s3:https://idr01.zata.ai/my-bucket/restic"
export RESTIC_PASSWORD_FILE="$HOME/.restic-password"
restic -o s3.bucket-lookup=path backup "$HOME/documents"
```

Make it private and executable:

```bash
chmod 700 ~/restic-backup.sh
```

Then run `crontab -e` and add this line to run it every night at 02:00:

**`crontab`**

```text crontab
0 2 * * * $HOME/restic-backup.sh >> $HOME/restic-backup.log 2>&1
```

## Troubleshooting

| Problem                          | Fix                                                                                                                    |
| -------------------------------- | ---------------------------------------------------------------------------------------------------------------------- |
| `unable to open config file`     | The repository does not exist yet. Run `restic -o s3.bucket-lookup=path init` once.                                    |
| Access denied or invalid key     | Copy the keys again from **Access Keys**. The key must be from the same region as the endpoint in `RESTIC_REPOSITORY`. |
| `wrong password or no key found` | Use the exact password you chose at `init`. It cannot be reset.                                                        |
| Repository URL errors            | The format is `s3:https://idr01.zata.ai/my-bucket/restic`. Do not write `s3:s3://`.                                    |

For other errors, see [Signature errors](/help/troubleshooting/signature-errors) and [Endpoint and region](/help/troubleshooting/endpoint-and-region).