Restic Backup to S3 for Small VPS: Complete How-To Tutorial (2026)

If you run a small website on a VPS, you need backups. Losing your site data is a nightmare. Restic is a fast, free, and safe backup tool. It works great with S3 storage. This guide shows you how to set up Restic backup to S3 on your small VPS step by step.

By the end of this tutorial, your website files, configs, and databases will be safe in the cloud. Even a beginner can follow along. Let us get started.

1. Prerequisites for Restic S3 Backup on Small VPS

1.1 Understanding Restic and S3-Compatible Storage

Restic is an open-source backup program. It encrypts your data before it leaves your server. It sends data to remote storage in small chunks. This saves bandwidth and storage space.

S3 is a storage service made by Amazon. Many companies offer S3-compatible storage. This means you can use tools built for AWS S3 with other providers too. Restic supports all of them.

1.2 Choosing the Right S3 Provider for Small Websites

Here is a quick look at the three popular options for small VPS owners:

Provider	Price (per TB/month)	Best For
AWS S3	$23.00	Full cloud setup, large projects
Wasabi	$6.99	Budget backup storage, no egress fees
Backblaze B2	$6.00	Low cost, good free tier (10 GB)

For a small VPS, Wasabi or Backblaze B2 are great picks. They are cheap and simple to use.

1.3 VPS Requirements and System Preparation

Your small VPS needs the following:

• A Linux server (Ubuntu 22.04+, Debian 12+, or similar)
• At least 512 MB RAM and 10 GB disk space
• Root access or a user with sudo rights
• A stable internet connection
• An S3 bucket already created at your chosen provider

Make sure your server time is correct. Run timedatectl to check. Wrong time can break SSL and S3 connections.

2. Install Restic 0.17+ on Your Small VPS

2.1 Download and Verify the Latest Restic Binary (2026)

Restic comes as a single file. You do not need a package manager. Here is how to get it:

1. Open your terminal and connect to your VPS via SSH.
2. Set the version you want. The latest stable release is 0.17.3+. Run:

curl -L https://github.com/restic/restic/releases/latest/download/restic_0.17.3_linux_amd64.bz2 -o restic.bz2

3. Unzip the file:

bzip2 -d restic.bz2

4. Move it to your system path and make it executable:

sudo mv restic /usr/local/bin/
sudo chmod +x /usr/local/bin/restic

2.2 Verify Installation with restic version

Now check that Restic works:

restic version

You should see output like restic 0.17.3 compiled with go1.22.x on linux/amd64. If you see this, you are good to go.

2.3 Create a Dedicated Backup System User

For security, do not run Restic as root. Create a backup user:

1. Create the user:

sudo useradd -r -m -s /bin/bash resticbackup

2. Give the user read access to website files:

sudo usermod -aG www-data resticbackup

3. Create a config directory:

sudo mkdir -p /etc/restic
sudo chown resticbackup:resticbackup /etc/restic

3. Configure S3 Credentials and Security for Restic Backup

3.1 Create a Secure Environment File (/etc/restic/backups.env)

Store your S3 keys in a file. Never put them in shell scripts or commit them to Git.

1. Create the env file:

sudo nano /etc/restic/backups.env

2. Add the following content:

AWS_ACCESS_KEY_ID=your_access_key_here
AWS_SECRET_ACCESS_KEY=your_secret_key_here
RESTIC_REPOSITORY=s3:s3.wasabisys.com/your-bucket-name
RESTIC_PASSWORD=your-secure-random-password

3. Lock down the file permissions:

sudo chmod 600 /etc/restic/backups.env
sudo chown resticbackup:resticbackup /etc/restic/backups.env

3.2 Set Up AWS IAM Least-Privilege Policy

Do not give your backup user full S3 access. Create a limited IAM policy. Here is a sample policy that only allows Restic backup to S3:

{
"Version": "2012-10-17",
"Statement": [
{
"Effect": "Allow",
"Action": ["s3:ListBucket", "s3:GetBucketVersioning"],
"Resource": "arn:aws:s3:::your-bucket-name"
},
{
"Effect": "Allow",
"Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],
"Resource": "arn:aws:s3:::your-bucket-name/*"
}
]
}

For Wasabi or Backblaze B2, check their docs for equivalent IAM setups.

3.3 Configure RESTIC_REPOSITORY and RESTIC_PASSWORD

The RESTIC_REPOSITORY variable tells Restic where to store data. For S3, the format is:

• AWS S3: s3:s3.amazonaws.com/bucket-name
• Wasabi: s3:s3.wasabisys.com/bucket-name
• Backblaze B2: s3:s3.us-west-004.backblazeb2.com/bucket-name

The RESTIC_PASSWORD encrypts all your data. Pick a long, random password. You can make one with: openssl rand -base64 32. Save this password in a safe place. If you lose it, you lose your backups forever.

3.4 Harden S3 Bucket with Object Lock and Encryption Enforcement

Object Lock stops anyone from deleting your backups by accident. Here is how to enable it:

1. In your S3 provider dashboard, find your bucket settings.
2. Enable “Object Lock” (also called “Write Once Read Many” or WORM).
3. Set a default retention period of 30 days.
4. Enable server-side encryption (SSE-S3 or SSE-KMS).

This adds a strong safety layer to your Restic backup to S3 setup.

4. Initialize Restic Repository on S3

4.1 Run restic init with Encryption Password

Before you can back up, you must create the repository. This sets up the structure on S3.

1. Switch to your backup user:

sudo su - resticbackup

2. Load the env file and run init:

source /etc/restic/backups.env
restic init

You will see a message like “created restic backend xxxxxxxx”. This means your S3 repository is ready.

4.2 Verify Repository Connection and Test Connectivity

Check that Restic can talk to your S3 bucket:

restic snapshots

If it returns an empty list (no error), your connection works. If you see an error, check your keys and bucket name in the env file.

5. Run Your First Restic Backup to S3

5.1 Select Directories for Small Website Backup

For a small VPS website, back up these key areas:

• /var/www — your website files
• /etc — server configuration files
• Database dumps — export your MySQL or PostgreSQL database first

To dump a MySQL database, run:

mysqldump -u root mywebsite > /var/backups/db-dump.sql

5.2 Add Tags for Server Identification

Tags help you find the right backup when you have many servers. Use the –tag flag:

restic backup /var/www /etc /var/backups --tag server:web01 --tag type:small-vps

5.3 Exclude Unnecessary Files

Do not waste space on cache, logs, or node_modules. Use an exclude file:

1. Create the exclude file:

nano /etc/restic/excludes.txt

2. Add patterns to skip:

node_modules
*.log
*.cache
/var/www/*/tmp
/var/cache/*

3. Use it in your backup command:

restic backup /var/www /etc /var/backups --exclude-file=/etc/restic/excludes.txt --tag server:web01

5.4 Execute Initial Backup and Monitor Progress

Run the full command:

source /etc/restic/backups.env
restic backup /var/www /etc /var/backups --exclude-file=/etc/restic/excludes.txt --tag server:web01 --verbose

The –verbose flag shows progress. The first backup takes the longest. Later backups are fast because Restic only sends changed data.

6. Verify and Test Restore from S3 Backup

6.1 List and Inspect Snapshots

After your first backup, list all snapshots:

restic snapshots

To see files in the latest snapshot:

restic ls latest

This shows every file that was saved to S3.

6.2 Run restic verify to Check Data Integrity

Make sure your data on S3 is not corrupt:

restic verify

This checks every file. If it says “no errors,” your Restic backup to S3 is healthy.

6.3 Perform Test Restore to /tmp/restore-test

Always test a restore. Pick a recent snapshot:

1. Create a test folder:

mkdir -p /tmp/restore-test

2. Restore the latest snapshot:

restic restore latest --target /tmp/restore-test

6.4 Validate Restored Website Files and Database

Compare the restored files with your live server:

diff -r /tmp/restore-test/var/www /var/www

Check that your database dump is valid:

mysql -u root -e "SELECT COUNT(*) FROM restored_table;" restored_db

If everything matches, your backup works. You can trust it.

7. Automate Restic S3 Backup with Systemd Timer

7.1 Create a Systemd Service File for Restic Backup

Do not rely on cron jobs alone. Systemd gives better logging and error handling.

1. Create the service file:

sudo nano /etc/systemd/system/restic-backup.service

2. Add this content:

[Unit]
Description=Restic Backup to S3
After=network-online.target
Wants=network-online.target

[Service]
Type=oneshot
User=resticbackup
EnvironmentFile=/etc/restic/backups.env
ExecStart=/usr/local/bin/restic backup /var/www /etc /var/backups --exclude-file=/etc/restic/excludes.txt --tag server:web01
Nice=19
IOSchedulingClass=idle

[Install]
WantedBy=multi-user.target

7.2 Set Up Daily Timer for Automated Backups

Create the timer file:

sudo nano /etc/systemd/system/restic-backup.timer

Add this content:

[Unit]
Description=Run Restic Backup Daily

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true
RandomizedDelaySec=3600

[Install]
WantedBy=timers.target

This runs Restic backup to S3 every day at 3:00 AM. The random delay avoids all servers hitting S3 at the same time.

Enable and start the timer:

sudo systemctl enable --now restic-backup.timer

7.3 Configure Log Rotation and Backup Logging

Systemd keeps logs in the journal. To view backup logs:

journalctl -u restic-backup.service --since today

To save logs to a file, add this to the service file under [Service]:

StandardOutput=append:/var/log/restic-backup.log
StandardError=append:/var/log/restic-backup.log

Set up log rotation with logrotate. Create a file at /etc/logrotate.d/restic-backup:

/var/log/restic-backup.log {
weekly
rotate 12
compress
missingok
}

7.4 Add Post-Backup Verification Step to Automation

Create a second service for pruning and checking:

sudo nano /etc/systemd/system/restic-verify.service

[Unit]
Description=Restic Verify and Prune
After=restic-backup.service

[Service]
Type=oneshot
User=resticbackup
EnvironmentFile=/etc/restic/backups.env
ExecStart=/usr/local/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
ExecStartPost=/usr/local/bin/restic check

This runs after each backup. It cleans up old data and verifies the repository.

8. Manage Retention Policies and Optimize Storage Costs

8.1 Implement restic forget Retention Strategy

The restic forget command removes old snapshots. A good policy for a small VPS is:

• Keep 7 daily backups
• Keep 4 weekly backups
• Keep 6 monthly backups

Run this command:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

The –prune flag also removes the actual data from S3 for deleted snapshots. Without prune, data stays until the next separate prune run.

8.2 Run restic prune to Reclaim S3 Storage Space

If you used forget without –prune, run prune by itself:

restic prune

This removes unused data blocks from S3. It can free a lot of space after many backup runs.

8.3 Compare Monthly S3 Costs for Small VPS

Here is a cost estimate for a small VPS with 50 GB of backup data:

Provider	Storage Cost	Egress Cost	Monthly Total (est.)
AWS S3 Standard	$1.15	$0.09/GB	~$1.50
Wasabi	$0.35	Free (with limits)	~$0.35
Backblaze B2	$0.30	$0.01/GB	~$0.31

Wasabi has a minimum retention rule of 90 days. Check their terms before choosing.

8.4 Optimize Backup Frequency and Data Size for Budget

To keep costs low on your small VPS:

• Back up once daily. More is rarely needed for small sites.
• Exclude cache and log files to reduce data size.
• Compress database dumps before backup.
• Use restic stats to see how much data you store.

Run restic stats to check your total storage use. This helps you budget your S3 costs each month.

9. Set Up Backup Monitoring and Alerts

9.1 Integrate Backup Health Checks with Systemd

Use systemd to know if a backup fails. Add a check in the service file:

ExecStartPost=/bin/bash -c 'if [ $EXIT_STATUS -ne 0 ]; then echo "BACKUP FAILED" | mail -s "Restic Alert" admin@yoursite.com; fi'

9.2 Configure Failure Notifications via Email or Slack

Install a simple mail tool:

sudo apt install mailutils

Or send a Slack message using a webhook:

curl -X POST -H "Content-type: application/json" --data '{"text":"Restic backup on web01: status=success"}' YOUR_SLACK_WEBHOOK_URL

9.3 Track Backup Status and S3 Storage Usage Over Time

Create a simple status script at /usr/local/bin/restic-status.sh:

#!/bin/bash
source /etc/restic/backups.env
echo "=== Latest Snapshots ==="
restic snapshots --last 5
echo "=== Storage Stats ==="
restic stats

Run it anytime to see the state of your Restic backup to S3.

10. Troubleshoot Common Restic S3 Backup Issues

10.1 Fix Connection Errors and Timeout Issues

If you see “connection refused” or timeout errors:

• Check your S3 endpoint URL in the env file.
• Test with curl to your endpoint URL.
• Make sure port 443 is open on your VPS firewall.
• Try adding –s3.endpoint https://your-endpoint to the command.

10.2 Resolve Permission Denied and IAM Policy Errors

If you see “AccessDenied” or “403 Forbidden”:

• Check your AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY.
• Make sure the IAM user has s3:PutObject and s3:GetObject on the bucket.
• Verify the bucket name is correct.
• For Wasabi and B2, make sure the access keys are from an S3-compatible API user, not the main account.

10.3 Diagnose Slow Upload Speeds on Small VPS

Small VPS plans sometimes have slow network. To speed things up:

• Use –compression max to reduce data size before upload.
• Exclude large files you do not need to back up.
• Run backups at off-peak hours (early morning).
• Set GOMAXPROCS=1 for very small (512MB RAM) VPS to reduce memory use.

10.4 Handle Repository Lock Conflicts and Stale Snapshots

If you see “repository is already locked”:

1. Make sure no other Restic process is running: ps aux | grep restic
2. Remove stale locks: restic unlock
3. If the lock stays, wait a few minutes and try again.

11. FAQ: Quick Answers About Restic Backup to S3

Q: Can I use Restic backup with any S3 provider?

Yes. As long as the provider supports the S3 API, Restic works. AWS S3, Wasabi, Backblaze B2, Minio, and many others are supported.

Q: How much does it cost to back up a small website?

For a 50 GB website, expect to pay about $0.35 to $1.50 per month depending on the provider. Restic itself is free.

Q: Is my data safe in S3?

Yes. Restic encrypts all data with AES-256 before it leaves your server. Even the S3 provider cannot read your files. Use a strong, unique password.

Q: Can I restore a single file?

Yes. Use restic restore latest --target /tmp/ --include /var/www/html/index.html to get back one file.

Q: How fast is the first backup?

The first backup depends on your data size and upload speed. For 10 GB on a 100 Mbps connection, expect about 15 to 20 minutes. Later backups are much faster.

Q: What if I forget my Restic password?

You cannot recover it. Without the password, your backups are gone forever. Store the password in a password manager.

12. Conclusion and Next Steps for Your VPS Backup Strategy

You now have a solid Restic backup to S3 setup for your small VPS. Let us review what you learned:

• Install Restic as a single binary on your Linux VPS.
• Set up S3 credentials in a secure env file with limited IAM permissions.
• Initialize the Restic repository with strong encryption.
• Run your first backup with tags, excludes, and verbose logging.
• Verify and test restore to make sure backups are valid.
• Automate backups with systemd timer for hands-free operation.
• Manage retention with restic forget and restic prune.
• Monitor backup health and get alerts on failure.

Next steps to consider:

• Set up a second S3 bucket in a different region for disaster recovery.
• Test a full server restore to a new VPS at least once per quarter.
• Keep your Restic binary up to date. Check restic version monthly.
• Share this guide with others who run small websites.

Backups are not optional. With Restic and S3, you get a cheap, secure, and automatic safety net for your small VPS. Start now. Your future self will thank you.