Off-Site Backup for a Homelab: restic or Kopia to Object Storage, and Testing Restores

Every homelab eventually has a scary moment: a pool that won’t import, a command run on the wrong dataset, or ransomware on a share. Redundancy (RAID, ZFS mirrors) and snapshots help with some of these, but not all. For the rest you need a copy off-site, and proof you can get it back.

The 3-2-1 rule, briefly

• 3 copies of the data (the original plus two backups)
• on 2 different kinds of storage
• with 1 copy off-site

Snapshots on the same pool count as convenience, not as a copy: if the pool dies, they die with it.

restic or Kopia?

Both are free, open-source and solid, and they work the same way: deduplicated, compressed, encrypted on your machine before upload, sent to a local disk, an SFTP server or S3-compatible object storage.

Pick one and stick with it. The habits below matter more than the tool.

Choosing where to send it

Any S3-compatible object storage works. When comparing providers, check:

• Storage price per TB per month.
• Egress and API charges. Restores cost money at some providers, and that bill arrives on your worst day.
• Minimum storage duration. Some charge for 30–90 days even if you delete sooner, which interacts badly with daily pruning.
• Object lock / immutability. It stops a compromised machine from deleting its own backups.

Another option is a friend’s NAS over SFTP or a VPN, with each of you hosting the other’s encrypted backups.

A minimal restic setup

# Credentials and the repository password come from environment variables (or a file only root can read)
export AWS_ACCESS_KEY_ID=...  AWS_SECRET_ACCESS_KEY=...
export RESTIC_REPOSITORY=s3:https://<endpoint>/<bucket>/homelab
export RESTIC_PASSWORD_FILE=/root/.restic-pass

restic init                                   # once
restic backup /mnt/tank/photos /mnt/tank/docs --exclude-caches
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune
restic check                                  # verify repository structure

Run the backup daily from a systemd timer or your NAS’s task scheduler, and send yourself an alert when it fails. Silent backup failures are the most common way backups go missing.

Lock it down

• Give the backup job its own access key, limited to that one bucket.
• Protect the backups from the machine being backed up. If ransomware gets onto your server, it can use the backup job’s credentials to delete the backups too. Don’t simply take away the key’s delete permission: restic has to delete its own lock files in the repository, so a no-delete S3 key causes failed or stale locks. What works instead:
  • restic: back up to a rest-server started with --append-only, which accepts new backups but refuses deletions. Run forget --prune separately, from a trusted machine with direct access to the storage.
  • Kopia: it supports S3 Object Lock retention directly. See Kopia’s ransomware protection guide.
  • Object storage: the bucket must have Object Lock enabled; see AWS S3 Object Lock or Backblaze B2 Object Lock. Locked objects can’t be deleted until their retention period ends, so choose a period you can afford to pay for.
• Store the repository password in your password manager and offline (printed, in a safe place). Without it, the backups can’t be decrypted. That’s the point, and also the risk.

Test restores: the part everyone skips

restic snapshots                                  # what do we have?
restic restore latest --target /tmp/restore-test --include /mnt/tank/docs/taxes
restic check --read-data-subset=5%                # actually read and verify some data

Make it a habit:

• Monthly: restore a handful of files to a temporary folder and open them.
• Twice a year: restore a whole service (for example the photo library) onto another machine, and time it. That number is your real recovery time.
• Write down the steps where you’ll find them when the NAS is down: not only on the NAS.

Checklist

1. Decide what must survive a house fire: photos, documents, password vault exports, configs.
2. Pick restic or Kopia, and an off-site target with known restore costs.
3. Automate daily backups with alerts on failure.
4. Restrict the backup key, and protect backups with rest-server append-only mode or Object Lock.
5. Store the encryption password in two places.
6. Test a restore this week, then put the next one in your calendar.

Sources

• restic: preparing a repository (S3), backing up, removing snapshots (forget, --prune), checking a repository (check --read-data-subset), restoring (restore --include), rest-server and append-only mode
• Kopia: getting started, ransomware protection and Object Lock
• Object Lock: AWS S3, Backblaze B2

Checked 2026-10-12.

Written by an AI persona. Check it before you run it. See Terms.