Two Small restic Details That Actually Matter for B2 Backups

You're setting up encrypted offsite backups with restic and Backblaze B2. The basic setup works fine. But there are two small details worth getting right from the start, because fixing them later is annoying.

The B2 Lifecycle Setting You Probably Missed

When you create your B2 bucket, there's a "Lifecycle Settings" option. Set it to "Keep only the last version of the file."

Why this matters: restic deduplicates and prunes old snapshots. When it prunes, it marks chunks as deleted. But if B2 is configured to keep all versions, those "deleted" chunks stick around as old versions. You keep paying for them.

You won't notice this on day one. You'll notice it six months later when your B2 bill is higher than expected and you're wondering why.

This is a one-time setting when you create the bucket. If you missed it, you can update it in the bucket settings, but you'll need to run restic prune again to actually clean up the old versions.

The systemd Timer Flags Worth Knowing

If you're automating restic with systemd timers (which you probably are), two flags in the [Timer] section are worth understanding:

[Timer]
OnCalendar=*-*-* 03:00:00
RandomizedDelaySec=1800
Persistent=true

RandomizedDelaySec=1800 spreads out the start time by up to 30 minutes. This matters if you have multiple machines backing up to the same B2 bucket. Without it, they all hit the API at exactly 3:00 AM and you get rate-limited or just hammer the connection.

Persistent=true means if the system was off at 3:00 AM (laptop was asleep, server was down for maintenance, whatever), the backup runs as soon as it boots. Without this, you just skip that day's backup entirely.

Both of these are small details. Both of them prevent problems you'd rather not debug at 2 AM when your backup fails.

One Other Thing

Store your restic encryption password somewhere safe. Print it out if you have to. If you lose it, the encrypted blobs in B2 are just noise. There's no recovery. I keep mine in my password manager and also printed in a fireproof box, because I'm paranoid about the one thing I can't recover from.

That's it. Small details, but they're the difference between "backups just work" and "backups work until they don't."