WIUNIX ACADEMY
Restic offsite backup: prove a specific snapshot restores before trusting it
Page 3 of 3. Review the earlier steps and prerequisites before continuing.
YOUR SYSTEM. YOUR STEPS.
Where are you working?
Choose your OS and version. The prerequisites, commands and troubleshooting follow your environment.
USE YOUR OWN VALUES
Configure this tutorial
Set the example values for your environment; related explanations and copy panels update together. Never enter passwords, private keys or tokens. Values stay in this tab and are not sent to the server or share links. Check actual DNS, certificates and network policy before running commands.
Different IP addresses, domains or ports? Open the settings below, change the values and select “Apply to tutorial”, then copy the updated commands.
Set values for my environment7 editable values
LET’S BUILD
Handle interrupted jobs without destructive shortcuts
For connection/read errors, verify SSH reachability and repository identity, then repeat the read/check after the cause is corrected. A failed check may mean unreadable data, not necessarily proven corruption; do not claim integrity while reads fail. Never unlock a repository before proving no backup/check/restore still holds an active lock. Do not run repair, prune or delete packs as a generic troubleshooting step.
Operator terminal; authorized lab context
unset RESTIC_PASSWORD RESTIC_PASSWORD_COMMAND
export RESTIC_REPOSITORY='sftp:backup@backup.example.com:/srv/restic/academy-repo'
export RESTIC_PASSWORD_FILE='/home/operator/academy-restic-private/repository-password'
restic list locks
restic snapshots --host 'app1' --path '/srv/backup-export'
ssh -o BatchMode=yes -o StrictHostKeyChecking=yes 'backup@backup.example.com' 'pwd'A specific access/read/lock cause is identified; repository data and active jobs remain intact.
LET’S BUILD
Review retention with a dry run only
This optional preview shows a candidate retention policy for the selected host/path; it deletes nothing. Review actual grouping, legal/business retention and an independent recovery copy before authorizing deletion/prune. An encrypted backup on a writable remote host is not ransomware immunity. Keep password recovery and periodic restore rehearsal under separate custody.
Operator terminal; authorized lab context
unset RESTIC_PASSWORD RESTIC_PASSWORD_COMMAND
export RESTIC_REPOSITORY='sftp:backup@backup.example.com:/srv/restic/academy-repo'
export RESTIC_PASSWORD_FILE='/home/operator/academy-restic-private/repository-password'
restic forget --host 'app1' --path '/srv/backup-export' --keep-daily 7 --keep-weekly 4 --dry-runThe candidate retention is reviewed as a preview; no snapshot or pack is deleted.
Keep recovery evidence and preserve originals
Record client version, repository ID, exact snapshot ID, source consistency method, backup exit code, check scope, restore duration, byte comparison and application acceptance gaps. If restore fails, preserve source and repository; retry into another new authorized target after diagnosing the cause. The rehearsal directory and protected key are not disposable merely because this article ends. This guide was documentation-reviewed; no real backup, remote transfer, repository mutation or application recovery was executed during authoring.
GO TO THE SOURCE
Official references
Each environment states how it was reviewed. A documentation review does not claim a hands-on test of every version.