Encrypted before it leaves the machine

A restic rest-server runs on the NAS. The PC runs a PowerShell script on a schedule and the laptop runs a systemd timer. Each backs up the folders I care about and skips caches, game installs and build output through an excludes list.

restic encrypts everything on the client, so the NAS only ever holds ciphertext. The repository password is read from a local encrypted file at run time, never stored in the script.

Backups are only real once you restore one

The NAS storage is a hardware RAID, which protects against a dead disk but not against deleting the wrong folder. Restic snapshots cover that second case.

The excludes list matters. Caches, toolchains, game launchers, temp folders and anything that can be re-created are left out, so the weekly run stays small. The script keeps the last two snapshots and prunes the rest.