When I first automated Restic backups with cron, I made the classic mistake of putting the repository password in an environment variable. It seemed convenient—just export RESTIC_PASSWORD before the job runs. But then I remembered how easily env vars can leak: through ps output, debug logs, or even careless sharing of automation scripts. That’s when I switched to using --password-file, and it made a meaningful difference in how I manage backup security.
Using --password-file lets you keep the password out of the environment and your process table. Instead of relying on RESTIC_PASSWORD, you point Restic to a file containing just the password, ideally with strict permissions. This reduces the attack surface significantly, especially in multi-user systems or when logs are aggregated centrally.
Here’s how I set it up in practice. First, I create a dedicated password file:
sudo touch /etc/restic/passwords/my-backup-repo
sudo chmod 600 /etc/restic/passwords/my-backup-repo
sudo chown root:root /etc/restic/passwords/my-backup-repoI make sure only root can read it—no need for broader access. Then I add the password (or better yet, a high-entropy passphrase) to that file, one line only, no extra whitespace.
In the cron job, I reference it directly:
0 2 * * * /usr/bin/restic backup /srv/data \
--repo s3:s3.amazonaws.com/my-bucket/backups \
--password-file /etc/restic/passwords/my-backup-repo \
--verboseNotice there’s no export of RESTIC_PASSWORD here. The password never touches the environment. Even if someone runs ps aux during the backup, they won’t see the credential.
I also like to wrap this in a small script to handle logging and exit codes cleanly, especially when monitoring with tools like systemd timers or Prometheus node-exporter. But even in raw cron, this approach is safer.
One thing to watch out for: if you’re using repository initialization or forget operations, you’ll need the same --password-file flag there too. Forgetting it leads to prompts that break automation. I keep a helper function in my admin notes:
restic_init() {
local repo="$1"
local pwfile="/etc/restic/passwords/$2"
restic init --repo "$repo" --password-file "$pwfile"
}This way, I don’t have to remember the flag every time—consistency reduces human error.
As I mentioned before in my post about securing secrets in automation, the goal isn’t perfection—it’s reducing risk in ways that don’t add operational friction. Using --password-file is one of those low-effort, high-return practices. It’s built into Restic, requires no extra tooling, and works whether you’re backing up to S3, SFTP, or a local drive.
If you’re still using environment variables for Restic passwords in cron, consider migrating. Rotate the password, update the file, and remove the export line. Your future self—especially during a security review—will thank you.
Cover image: Unknown · CC0 (Openverse / kamu malı) · https://www.rawpixel.com/image/3295250/free-photo-image-creative-commons-cc0-computer