Restic to this box over SFTP: the setup I ended up with

2026-08-30

For two years my off-site backup was a USB disk at my parents' place. It worked until it didn't: the disk was full, nobody noticed, and the last good snapshot was four months old. This VPS is the replacement. It has one job at night.

Server side

A dedicated user with a locked password and an SSH key restricted to SFTP. No shell, no port forwarding, chrooted into its own directory.

Match User backup
    ChrootDirectory /srv/backup
    ForceCommand internal-sftp
    AllowTcpForwarding no
    X11Forwarding no

The chroot directory has to be owned by root and not writable by the user, which trips everyone up the first time. The repository lives in a subdirectory the user does own.

Client side

One systemd timer on the NAS, 03:10 every night. The unit runs restic backup with --exclude-caches and then restic forget --prune with 7 daily, 5 weekly, 12 monthly. Prune only on Sundays; it is the slow part and the disk is small.

The thing I would tell past me: run restic check --read-data-subset=5% once a week. A backup nobody has restored from is a hypothesis, not a backup. I do a full test restore of one folder every quarter and put the date in a calendar.

Bandwidth is the limit here, not CPU. The first upload of 600 GB took the better part of a week at the rate my home line allows. After that it is a few hundred megabytes a night.