How to Install restic on Debian: Fast, Encrypted, Deduplicated Backups

restic is a backup program that is fast, efficient and secure. It splits your data into content-defined chunks and stores each chunk only once, so repeated backups cost almost nothing, and it encrypts and authenticates everything on the client before a single byte leaves the machine. The same single Go binary backs up to a local disk, an SFTP server, a REST server, Amazon S3 and S3-compatible storage, Backblaze B2, Azure, Google Cloud Storage, or anything rclone can reach.

Debian does ship a restic package, but stable releases stand still for years: Bookworm carries 0.14.0 and Trixie 0.18.0. For a backup tool that matters, because newer releases bring faster restores, better compression handling, repository format improvements and fixes you really want in place before the day you need to restore.

The unofficial deb.griffo.io repository closes that gap. It packages current restic releases as a drop-in replacement for Debian’s own restic package (same name, same paths) served over APT, complete with man pages and shell completions, so you track upstream while installing and updating with the tooling you already run.

Install the Latest restic on Debian: The Short Version

If you only came for the commands, this adds the repository and installs the latest restic .deb package on Debian:

sudo install -d -m 0755 /etc/apt/keyrings
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null
sudo apt update
sudo apt install restic

The rest of this guide explains what each command does, how to verify the install, how to make your first backup, how to keep restic up to date, and what to check when something goes wrong.

What Makes restic Special?

• 🔐 Encrypted by default - Every repository is encrypted and authenticated with a password; there is no unencrypted mode to forget about.
• 🧩 Deduplication - Content-defined chunking stores identical data once, across files, snapshots and even machines sharing a repository.
• ⚡ Fast incremental backups - Only changed files are read, and only new chunks are uploaded.
• ☁️ Many backends - Local directories, SFTP, REST server, S3 and S3-compatible storage, B2, Azure, GCS, Swift and every rclone remote.
• 📸 Snapshots - Each backup is a point-in-time snapshot you can list, compare, tag and restore independently.
• 🗂️ Mount as a filesystem - Browse every snapshot through FUSE and copy back just the files you need.
• 🧹 Flexible retention - Keep the last N daily, weekly, monthly or yearly snapshots and prune the rest in one command.
• ✅ Verifiable - restic check validates repository structure and, on demand, the actual data.
• 📦 Single static binary - No runtime dependencies, which is exactly what you want in a recovery situation.

Why Use the deb.griffo.io Repository?

• Much newer than Debian stable, which is frozen on the restic version that existed at release time.
• Drop-in replacement for Debian’s restic package, with the same package name and file layout.
• Easy installation and updates through APT, no hand-downloaded binaries or restic self-update.
• Man pages and shell completions included for bash, fish and zsh, generated at build time.
• Built from signature-verified upstream binaries for amd64, arm64, armhf, ppc64el, s390x, riscv64 and i386.
• Works across supported Debian releases, with the codename detected automatically.

Prerequisites

Before you start, make sure you have:

• A Debian-based system (Bookworm 12, Trixie 13, Forky, or Sid)
• sudo privileges
• curl installed (sudo apt install curl if needed)

restic has no hard dependencies. The package suggests ca-certificates, which you need for any HTTPS backend, and fuse3, which is only required if you want to mount snapshots with restic mount.

Step 1: Add the deb.griffo.io Repository

Add the signing key and repository source:

# Create the keyrings directory
sudo install -d -m 0755 /etc/apt/keyrings

# Download and install the repository GPG key
curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg

# Add the repository (auto-detects your distro codename)
echo "deb [signed-by=/etc/apt/keyrings/deb.griffo.io.gpg] https://deb.griffo.io/apt $(lsb_release -sc 2>/dev/null) main" | sudo tee /etc/apt/sources.list.d/deb.griffo.io.list > /dev/null

# Update the package list
sudo apt update

What each command does:

1. Create the keyrings directory - ensures /etc/apt/keyrings exists with proper permissions.
2. Install the GPG key - downloads the repository key and de-armours it into a dedicated keyring for verification.
3. Add the repository - writes a signed-by source line, with lsb_release -sc supplying your Debian codename.
4. Update the package list - refreshes APT so it knows about the new packages.

Step 2: Update the Package List

If you skipped the last line, run the update now:

sudo apt update

Step 3: Install restic

Install restic with APT:

sudo apt install restic

Because Debian also carries a restic package, it is worth confirming which one APT chose:

apt policy restic

The deb.griffo.io version is newer, so APT prefers it on its own. If you plan to mount snapshots, install FUSE as well:

sudo apt install fuse3

Step 4: Verify the Installation

The binary is simply restic. Confirm the version:

restic version

You should see output similar to:

restic 0.19.1 compiled with go1.25.1 on linux/amd64

Every subcommand has its own help page (restic backup --help) and its own man page (man restic-backup).

Getting Started with restic

Create a Repository

A repository is where restic stores encrypted snapshots. Start with a local directory, for example on an external disk:

# Initialise a new repository; restic asks for a password twice
restic -r /srv/restic-repo init

Do not lose that password. The data is encrypted with it, and there is no recovery if it is gone.

Back Up and List Snapshots

# Back up your home directory
restic -r /srv/restic-repo backup ~

# Skip caches and anything listed in an exclude file
restic -r /srv/restic-repo backup ~ --exclude-caches --exclude-file ~/.config/restic/excludes

# Tag a snapshot so it is easy to find later
restic -r /srv/restic-repo backup ~/work --tag work

# List snapshots
restic -r /srv/restic-repo snapshots

Run the same backup command again and restic reads only what changed, adding a new snapshot in seconds.

Avoid Typing the Repository and Password

restic reads its repository and password from the environment, which is how you script it:

# Keep the password in a file only you can read
install -d -m 0700 ~/.config/restic
printf '%s\n' 'a-long-random-passphrase' > ~/.config/restic/password
chmod 600 ~/.config/restic/password

export RESTIC_REPOSITORY=/srv/restic-repo
export RESTIC_PASSWORD_FILE=~/.config/restic/password

restic snapshots

RESTIC_PASSWORD_COMMAND works too if you would rather fetch the password from a secret manager.

Remote Backends: SFTP, REST Server and S3

The repository location decides the backend:

# SFTP, using your existing SSH configuration and keys
restic -r sftp:user@backup-host:/srv/restic-repo init

# A restic REST server
restic -r rest:https://backup-host:8000/my-laptop init

# Amazon S3 or an S3-compatible service
export AWS_ACCESS_KEY_ID=<YOUR-ACCESS-KEY-ID>
export AWS_SECRET_ACCESS_KEY=<YOUR-SECRET-ACCESS-KEY>
restic -r s3:s3.us-east-1.amazonaws.com/my-bucket init

# A self-hosted S3-compatible server
restic -r s3:https://s3.example.com/my-bucket init

Every other command works identically against any backend.

Restore Files

# Restore the latest snapshot to a separate directory
restic -r /srv/restic-repo restore latest --target /tmp/restore

# Restore only part of a snapshot
restic -r /srv/restic-repo restore latest --target /tmp/restore --include /home/user/Documents

# Or browse every snapshot as a filesystem (needs fuse3)
mkdir -p /mnt/restic
restic -r /srv/restic-repo mount /mnt/restic

The mount stays active until you press Ctrl-C or unmount it. Snapshots appear under snapshots/, hosts/ and tags/, and you can copy files out with any tool you like.

Retention and Pruning

# Preview what a retention policy would remove
restic -r /srv/restic-repo forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --dry-run

# Apply it and reclaim the space in one step
restic -r /srv/restic-repo forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

forget removes snapshot references; --prune then deletes the data no remaining snapshot needs.

Check Repository Integrity

# Verify the repository structure
restic -r /srv/restic-repo check

# Also read back and verify a random 10% of the actual data
restic -r /srv/restic-repo check --read-data-subset=10%

A backup you have never checked is a hope, not a backup. Run check regularly, and do a real test restore now and then.

Scheduling Backups with systemd

A system service and timer keep backups running without a login session. Put the settings in an environment file readable only by root:

sudo install -d -m 0700 /etc/restic
sudo tee /etc/restic/env > /dev/null <<'EOF'
RESTIC_REPOSITORY=sftp:user@backup-host:/srv/restic-repo
RESTIC_PASSWORD_FILE=/etc/restic/password
EOF
sudo chmod 600 /etc/restic/env

Then create the unit files:

# /etc/systemd/system/restic-backup.service
[Unit]
Description=restic backup
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/env
ExecStart=/usr/bin/restic backup /etc /home --exclude-caches
ExecStartPost=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

# /etc/systemd/system/restic-backup.timer
[Unit]
Description=Daily restic backup

[Timer]
OnCalendar=daily
Persistent=true
RandomizedDelaySec=30m

[Install]
WantedBy=timers.target

Enable it and trigger a first run to make sure it works:

sudo systemctl daemon-reload
sudo systemctl enable --now restic-backup.timer
sudo systemctl start restic-backup.service
journalctl -u restic-backup.service

Persistent=true makes up for runs missed while the machine was switched off.

Keeping restic Updated

Because restic arrived via APT, updates come with the rest of the system:

sudo apt update && sudo apt upgrade

Whenever deb.griffo.io ships a newer restic, apt upgrade installs it automatically. Do not use restic self-update here: it is intended for the official standalone binaries and would overwrite /usr/bin/restic, a file the package manager owns, leaving APT and the installed binary out of sync.

Other Tools from deb.griffo.io

The repository packages plenty of tools that fit naturally alongside restic:

• Garage - a lightweight, self-hosted S3-compatible object store that makes a great restic target.
• Headscale - a self-hosted Tailscale control server for reaching your backup host privately.
• just - a command runner for keeping your backup, check and restore recipes in one place.
• Yazi - a blazing fast terminal file manager for browsing a mounted snapshot.

Troubleshooting

GPG or Key Errors

If APT reports an unsigned repository or an invalid key, import it again:

curl -fsSL https://deb.griffo.io/EA0F721D231FDD3A0A17B9AC7808B4DD62C41256.asc | sudo gpg --dearmor --yes -o /etc/apt/keyrings/deb.griffo.io.gpg
sudo apt update

Package Not Found

If APT cannot see the restic package from the repository:

1. Re-run sudo apt update after adding the repository.
2. Confirm your release is supported (Bookworm, Trixie, Forky, or Sid).
3. Inspect the source list: cat /etc/apt/sources.list.d/deb.griffo.io.list.

APT Installed the Debian Version Instead

Debian’s own archive also carries restic, so two candidates exist. Check which one won:

apt policy restic

If the older archive version is installed, refresh the package lists and upgrade to the repository version:

sudo apt update
sudo apt install --only-upgrade restic

restic mount Fails

Mounting needs FUSE. Install it and try again:

sudo apt install fuse3

Also make sure the mountpoint is an empty directory and is not inside a local repository.

”Unable to Create Lock” or a Stale Lock

A backup that was killed may leave a lock behind. Once you are certain no other restic process is using the repository, remove stale locks:

restic -r /srv/restic-repo unlock

Conflicting restic Installations

If you previously downloaded the official binary into /usr/local/bin or ~/bin, that copy may shadow the packaged one:

which -a restic

Remove the stray binary so the APT-managed restic in /usr/bin is the one you run.

Uninstalling

Remove restic with:

sudo apt remove restic

Removing the program does not touch your repositories or your backed-up data. To also drop the repository and key:

sudo rm /etc/apt/sources.list.d/deb.griffo.io.list
sudo rm /etc/apt/keyrings/deb.griffo.io.gpg
sudo apt update

Conclusion

Backups are the one piece of infrastructure you only find out about when it is too late, which is a good reason to run a current, well-maintained tool. Installing restic from deb.griffo.io gives Debian users upstream releases as a drop-in replacement for the archive package, with APT handling upgrades and man pages and completions included.

Add the repository once, initialise a repository, point a systemd timer at it, and schedule a restic check alongside. From then on, staying on the latest restic is part of the same apt upgrade you were going to run anyway.

Frequently Asked Questions

How do I install the latest restic on Debian?

Add the deb.griffo.io APT repository and its signing key, then run sudo apt install restic. The repository tracks upstream restic releases, so you get the latest packaged version rather than a build frozen when your distribution was released.

Is there a .deb package for restic?

Yes. deb.griffo.io publishes restic as a signed .deb for Debian. You could download that .deb and install it by hand, but adding the repository is the better option: APT then resolves dependencies and picks up new versions on its own.

How do I update restic to the latest version?

Run sudo apt update && sudo apt upgrade. Skip restic self-update, which is meant for the official standalone binaries rather than packaged ones.

Will my existing repositories still work after upgrading from Debian’s restic?

Yes. Newer restic versions read repositories created by older ones, and the package is a drop-in replacement for Debian’s. Just avoid going back to a much older restic after migrating a repository to a newer format version with restic migrate.

How do I install restic on Ubuntu?

Exactly the same way; lsb_release -sc simply resolves to a different codename. There is a companion guide with the Ubuntu specifics: How to install restic on Ubuntu.

Which Debian releases are supported?

Bookworm 12, Trixie 13, Forky and Sid. Because the repository line is built from lsb_release -sc, the matching suite is selected for you.

Resources

• restic Website
• restic Documentation
• restic GitHub Repository
• restic Packaging Repository
• deb.griffo.io Repository
• Install guide on deb.griffo.io

---

Disclaimer: The deb.griffo.io repository is an unofficial community project and is not affiliated with the official Debian or Ubuntu projects, or with the upstream restic project.