skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

implementing-immutable-backup-with-restic

Implements immutable restic backups on S3-compatible storage with object lock and integrity verification.

954|172|Updated Mar 13, 2026
Search Tags:#ransomware#Disaster Recovery#restic#worm#backup verification#immutable backup#s3 object lock
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill implementing-immutable-backup-with-restic
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: implementing-immutable-backup-with-restic
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/ransomware-defense/implementing-immutable-backup-with-restic
Command: npx skills add https://github.com/xalgord/xalgorix --skill implementing-immutable-backup-with-restic

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Ransomware actors routinely delete or encrypt backups before triggering encryption, leaving organizations with no recovery path. This Skill builds a ransomware-resistant backup pipeline using restic with S3 Object Lock in Compliance mode, so backup snapshots cannot be deleted or modified by any principal, including compromised admin accounts.

Core Features & Use Cases

  • Immutable Repository Setup: Initializes an encrypted restic repository (AES-256-CTR with Poly1305-AES) on S3-compatible storage with Object Lock in Compliance mode for WORM retention.
  • Integrity Verification: Automates restic check --read-data to validate every data blob against its checksum, catching bit-rot and tampering.
  • Restore Testing & Retention Policy: Schedules restore tests with checksum comparison and enforces snapshot retention aligned with a 3-2-1-1-0 strategy.
  • Use Case: A security engineer hardens backup infrastructure after a ransomware tabletop exercise, configuring a 90-day Compliance-mode lock on AWS S3, append-only IAM credentials for the backup client, and weekly automated restore verification.

Quick Start

Set up an immutable restic backup repository on my S3 bucket with Compliance-mode object lock, a 90-day retention window, and scheduled integrity checks with restore testing.

Frequently Asked Questions about implementing-immutable-backup-with-restic

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I set up immutable backups with restic and S3 Object Lock?▼

Initialize an encrypted restic repository on an S3 bucket with Object Lock enabled in Compliance mode, which prevents any principal including root from deleting objects before retention expires. Set retention to 30-90 days, exceeding typical ransomware dwell time.

What is the difference between S3 Object Lock Governance and Compliance mode?▼

Governance mode allows any principal with s3:BypassGovernanceRetention permission to delete objects, so compromised admin credentials can wipe backups. Compliance mode blocks all deletion before retention expires, making it the correct choice for ransomware-resistant backups.

Does restic work with MinIO and Backblaze B2?▼

Yes, restic supports any S3-compatible storage including AWS S3, MinIO, and Backblaze B2, provided Object Lock is enabled on the bucket. MinIO offers self-hosted S3-compatible storage with Object Lock support.

Why does restic check not detect data corruption by default?▼

Plain restic check only validates repository structure, not blob contents. Use restic check --read-data or --read-data-subset to download and verify every data blob against its stored checksum, catching bit-rot and tampering.

When should I not rely solely on object lock backups?▼

Object lock protects against logical deletion but not physical storage failure, so it should not be the sole backup solution. Maintain offline or air-gapped copies alongside the immutable repository as part of a 3-2-1-1-0 strategy.

Related Skills

Explore More Software Engineering Skills→
Snowflake-LabsSnowflake-Labs

snow-utils-volumes

Automate Snowflake external volume provisioning with AWS S3 and IAM resources.

Official
Advanced
rampstackcorampstackco
523

backup-and-disaster-recovery

Plan and orchestrate backups and disaster recovery procedures for critical systems.

Official
Advanced
russellktrussellkt

pbs-monitoring

Monitors Proxmox Backup Server datastores, backup statuses, and missing recent backups.

Community
Intermediate
aws-samplesaws-samples
6

fsi-cyber-resilience

Implement cyber resilience with air-gapped backup and automated network isolation for core-banking workloads.

Official
Advanced