A backup you have never restored is a guess, and most home setups are guesses held together by an external drive in a desk drawer.
Why Restic and Backblaze B2 Work Well Together
Restic is an open-source command-line backup tool that encrypts your data on your own machine before anything leaves it. It splits files into chunks and uploads only the chunks it has not stored before. That deduplication means a new snapshot of a large photo library, where a handful of files changed, adds almost nothing to your storage bill. Every snapshot still looks like a complete point-in-time copy that you can browse or restore. Restic ships as a single binary for Linux, macOS, Windows, and BSD, so the same workflow carries across every machine in the house.
Backblaze B2 is object storage billed by usage, with no per-device plan and no client software to install. Restic includes a native B2 backend, so the two connect with a few environment variables. Because encryption happens locally, B2 only ever holds opaque blobs. Neither Backblaze nor anyone who gets hold of your bucket credentials can read file names or contents without the repository password.
The strategy this pairing supports is the familiar 3-2-1 rule: three copies of your data, on two kinds of storage, with one copy offsite. Your working files are copy one. A restic repository on a NAS or USB drive is copy two. A second restic repository in B2 is the offsite copy that survives a fire, a flood, or a burglary. Restic treats each repository independently, so you run the same backup command twice with a different target and get two separate safety nets.
Before touching any commands, decide what is irreplaceable. Photos, documents, password manager exports, dotfiles, and notes belong on the list. The operating system, application installs, download folders, and caches do not, and leaving them out keeps backups fast and cheap. If you run self-hosted services, dump their databases to a file first and back up the dump, because copying live database files can produce a snapshot that will not restore cleanly.
Setting Up the Repository and Running Your First Backup
Start in the Backblaze dashboard. Create a private bucket with a globally unique name, then generate an application key restricted to that single bucket instead of using your master key. Copy the key ID and the application key immediately, because the secret is shown only once. While you are in the bucket settings, set the lifecycle rule to keep only the last version of each file. Restic deletes files when it prunes old data, and without that rule B2 retains hidden prior versions that you keep paying for.
Next, install restic with your package manager (apt install restic on Debian and Ubuntu, brew install restic on macOS) and run restic self-update if the packaged version is old. Put your credentials in a file that only your user can read, such as a restic.env file with permissions set to 600, and load it before running restic. It should contain these lines:
- export B2_ACCOUNT_ID=”your-key-id”
- export B2_ACCOUNT_KEY=”your-application-key”
- export RESTIC_REPOSITORY=”b2:your-bucket-name:home”
- export RESTIC_PASSWORD_FILE=”$HOME/.config/restic/password”
The password file deserves more thought than the rest. Generate a long random passphrase, save it in your password manager, and keep a printed or offline copy somewhere physically separate from your computer. Restic has no recovery mechanism, so losing the passphrase means losing every snapshot permanently. Once the file is in place, run restic init to create the encrypted repository in your bucket. Then run restic backup ~/Documents ~/Pictures –exclude-file=$HOME/.config/restic/excludes.txt to take the first snapshot, which will take a while on a slow upload link while later runs finish quickly.
Confirm the backup before trusting it. restic snapshots lists what exists, and restic check verifies the repository structure. The real test is a restore: run restic restore latest –target /tmp/restore-test –include “/home/you/Documents/taxes” and open the files you get back. For a more casual look, restic mount /mnt/restic exposes snapshots as a browsable folder tree on systems with FUSE support.
Retention comes last. Without it the repository grows forever, so use restic forget –keep-daily 7 –keep-weekly 4 –keep-monthly 12 –prune to keep a week of dailies, a month of weeklies, and a year of monthlies. Pruning rewrites repository data and makes a lot of API calls against B2, so run it weekly rather than after every backup. To add the local second copy, point RESTIC_REPOSITORY at a path on your NAS or external drive, run restic init again, and repeat the same backup command.
Automating the Job and Proving It Works
A backup that depends on you remembering it will eventually stop happening. On Linux, a systemd service with an EnvironmentFile pointing at your credentials, paired with a timer set to OnCalendar=daily and Persistent=true, runs the job every day and catches up after a laptop has been asleep. Cron works fine on a always-on machine. Whichever you choose, add failure alerts through an email on error or a ping to a dead-man’s-switch service, because the most common way backups die is silently.
Schedule a restore drill the same way you schedule the backup. Running restic check –read-data-subset=1/12 in January, 2/12 in February, and so on downloads
