restic

One static binary, one repository, encrypted snapshots that deduplicate against everything already stored.

What it does

restic backup splits files into content-addressed chunks, encrypts them, and writes only the chunks the repository has never seen. A second snapshot of a mostly unchanged home directory costs almost nothing, and every snapshot is a full one to restore from.

Backends include a local path, SFTP, S3-compatible object storage, Backblaze B2, Azure, Google Cloud Storage and rclone — which in practice means anything.

export RESTIC_REPOSITORY=sftp:nas:/backups/laptop
restic init
restic backup ~/Documents ~/Code
restic snapshots
restic restore latest --target /tmp/restore

Notes

Repositories are append-only friendly, so a compromised client cannot delete history if the backend is configured for it.
No scheduler. Drive it from launchd, or from a wrapper like resticprofile.
restic forget --prune is what reclaims space; without it, snapshots accumulate for ever.

Alternative to

Alternative	Type	Trade-off
BorgBackup	Open source	Older and battle-tested, but needs Borg installed on the far end
Kopia	Open source	Same idea with a desktop app and policies; younger project
Arq	Paid	A scheduler and a GUI, for people who do not want to write one
Time Machine	Built in	Effortless locally, useless for off-site or for Linux hosts
rclone	Open source	Mirrors files rather than versioning them