Restic: REST server or SFTP for backups to a storage VPS?

Is rest-server faster than SFTP?

The rest-server project says yes: compared with SFTP, the REST backend performs better and scales further. Its README gives the reason: SFTP moves data in chunks of at most 32 KiB and the server acknowledges every packet, while REST sends whole files over HTTP. Plain HTTP removes the TLS overhead too, since restic already encrypts everything it sends; the README adds that HTTPS then mostly serves to protect the login. That is the project's own claim, not a benchmark we ran. On a storage VPS with hard disks, the disks and your uplink often set the pace before the protocol does.

On the client side, SFTP has one known annoyance: restic's documentation notes that SFTP servers close connections when they receive nothing for a while, which long scans of unchanged files can trigger.

When is plain SFTP the better choice?

When one machine you trust backs up to its own account and you want no extra service, no extra port and nothing new to patch. restic needs only restic -r sftp:user@host:/path init and an SSH key without a passphrase prompt, since an automatic backup cannot stop to ask for one. The weakness is the one that matters most against ransomware: whoever controls the client can also run restic forget --prune and delete every snapshot, because SFTP has no append-only mode.

To keep each SFTP account from browsing the rest of the server, OpenSSH can lock it into its own folder with no shell:

Match User restic-laptop
    ForceCommand internal-sftp
    ChrootDirectory /srv/restic-sftp/%u
    AllowTcpForwarding no
    X11Forwarding no

useradd --no-create-home --home-dir /srv/restic-sftp/restic-laptop --shell /usr/sbin/nologin restic-laptop
install -d -m 755 -o root -g root /srv/restic-sftp/restic-laptop
install -d -m 700 -o restic-laptop -g restic-laptop /srv/restic-sftp/restic-laptop/repo
install -d -m 700 -o restic-laptop -g restic-laptop /srv/restic-sftp/restic-laptop/.ssh
echo 'ssh-ed25519 AAAA...client-key... laptop' > /srv/restic-sftp/restic-laptop/.ssh/authorized_keys
chown restic-laptop:restic-laptop /srv/restic-sftp/restic-laptop/.ssh/authorized_keys
chmod 600 /srv/restic-sftp/restic-laptop/.ssh/authorized_keys

How do I run rest-server with append-only and private repositories?

On Debian 13, install restic-rest-server, point it at a data folder outside /home, and pass --append-only --private-repos plus TLS in its defaults file. The packaged service runs as the restic-rest-server user, reads BACKUP_DIR, LISTEN and ARGS from /etc/default/restic-rest-server, refuses to start until BACKUP_DIR is set, and hides /home from the daemon. With --private-repos, the user laptop may only open repositories under /laptop/, so several people can share one storage VPS without seeing each other's snapshots. A self-signed certificate is enough, because the client pins it with --cacert.

apt install restic-rest-server apache2-utils openssl
install -d -m 750 -o restic-rest-server -g restic-rest-server /srv/restic

openssl req -x509 -newkey rsa:3072 -nodes -days 3650 \
    -keyout /etc/restic-rest-server/key.pem -out /etc/restic-rest-server/cert.pem \
    -subj '/CN=coffer-backup' -addext 'subjectAltName=IP:203.0.113.10'
chown root:restic-rest-server /etc/restic-rest-server/key.pem
chmod 640 /etc/restic-rest-server/key.pem

cat > /etc/default/restic-rest-server <<'EOF'
BACKUP_DIR=/srv/restic
LISTEN=:8000
ARGS="--htpasswd-file /etc/restic-rest-server/users.htpasswd --append-only --private-repos --tls --tls-cert /etc/restic-rest-server/cert.pem --tls-key /etc/restic-rest-server/key.pem"
EOF

htpasswd -B /etc/restic-rest-server/users.htpasswd laptop
chown root:restic-rest-server /etc/restic-rest-server/users.htpasswd
chmod 640 /etc/restic-rest-server/users.htpasswd
systemctl enable restic-rest-server
systemctl restart restic-rest-server

mkdir -p ~/.config/restic
scp [email protected]:/etc/restic-rest-server/cert.pem ~/.config/restic/coffer.pem

cat > ~/.config/restic/coffer.env <<'EOF'
RESTIC_REPOSITORY=rest:https://203.0.113.10:8000/laptop/
RESTIC_REST_USERNAME=laptop
RESTIC_REST_PASSWORD=the-htpasswd-password
RESTIC_PASSWORD_FILE=/home/me/.config/restic/repo-password
RESTIC_CACERT=/home/me/.config/restic/coffer.pem
EOF
chmod 600 ~/.config/restic/coffer.env

set -a; . ~/.config/restic/coffer.env; set +a
restic init
restic backup ~/Documents ~/Pictures

How do I prune snapshots when rest-server is append-only?

Run forget --prune from a trusted admin machine over a path that is not append-only, and write the policy with --keep-within. rest-server keeps the repository in the same layout as a local repository, so SFTP as root reaches the very same folder, and the repository password never has to be typed on the VPS.

The --keep-within part matters. restic's documentation describes an attacker who adds empty snapshots to an append-only repository so that a policy such as one snapshot per week drops the real ones; a time-based policy keeps both the junk and the genuine snapshots. It only helps while the system clock is right when forget runs, and it is no reason to skip a look at restic snapshots first.

restic -r sftp:[email protected]:/srv/restic/laptop snapshots
restic -r sftp:[email protected]:/srv/restic/laptop forget --keep-within 90d --prune
restic -r sftp:[email protected]:/srv/restic/laptop check --read-data-subset=5%

Which backend should I pick?

Pick rest-server whenever the machine being backed up faces the internet; pick SFTP for a single, well-kept machine where simplicity wins. An append-only target cannot be emptied by the attacker who encrypts your server, and that one property outweighs the extra daemon.

What does a restic target cost per TB?

According to Coffervale's survey of 2 November 2026, Backblaze B2, an object store restic supports natively, cost $6.95 per TB a month, while storage VPS plans from hosts that take crypto without an ID document had a median of $4.00 per TB. An object store needs no server to maintain but offers neither of the two backends discussed here; a storage VPS runs both. We take no backup of your server and keep no copy of your data anywhere else, so what sits on a Coffervale storage VPS should be one of your copies, never the only one: the VPS is your off-site copy, as How do I use a VPS for off-site backups? explains. If you would rather use Borg, follow How do I set up a Borg backup server on a VPS?; to encrypt the disk underneath, see How do I mount and format the storage disk on a Linux VPS?. Plans and terms are on How much does a storage VPS cost per month?.