How to configure restic forget
and keep your storage sane

A restic retention policy is a set of --keep-* rules that decide which snapshots survive when you run restic forget. Restic never deletes anything on its own, so without a policy a repository grows for as long as you keep backing up. A working policy for most homelab and small-business setups is restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --keep-yearly 1 --prune. That keeps every day of the last week, one snapshot per week for a month, one per month for half a year, and one per year beyond that.

Two commands do different jobs. forget removes snapshot references and is instant and reversible until you prune. prune reclaims the actual disk space by deleting unreferenced data chunks, takes far longer, and is irreversible. Always run forget with --dry-run first to see exactly which snapshots would go.

Retention only decides what to keep. Proving those snapshots are readable is a separate job. See how to verify restic backups, and if you want the whole thing running unattended, a systemd timer handles scheduling without cron.

A retention policy only protects you if the repository host cannot be pruned by an attacker; our comparison of restic hosts shows which ones support append-only.

How restic retention works

Restic never deletes snapshots automatically. You run restic forget with flags that describe which snapshots to keep, and restic marks the rest for deletion. The --prune flag then removes the underlying data in the same command.

Important: restic forget without --prune only removes snapshot references. The data is still in the repository and still uses storage until you run restic prune.

Common retention policies

# Minimal: 7 days + 4 weeks
restic forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --prune

# Standard: daily + weekly + monthly
restic forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 6 \
  --prune

# Comprehensive: daily + weekly + monthly + yearly
restic forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 12 \
  --keep-yearly 2 \
  --prune

What each flag means

• --keep-daily <N>:Keep the most recent snapshot from each of the last N days that had at least one snapshot.
• --keep-weekly <N>:Keep the most recent snapshot from each of the last N calendar weeks.
• --keep-monthly <N>:Keep the most recent snapshot from each of the last N calendar months.
• --keep-yearly <N>:Keep the most recent snapshot from each of the last N years.
• --keep-last <N>:Always keep the last N snapshots regardless of time. Useful as a safety floor.
• --keep-within 30d:Keep all snapshots within the last 30 days. Good for compliance windows.

Targeting by host or tag

If you back up multiple machines to the same repository, always target forget by host or tag to avoid accidentally pruning another machine's snapshots.

# Forget only snapshots from this host
restic forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --host $(hostname) \
  --prune

# Forget only snapshots with a specific tag
restic forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --tag production \
  --prune

Retention on ServerCrate vaults

Every ServerCrate vault has two endpoints on the same repository. The backup endpoint your servers write to is append-only: it can add snapshots but has no power to delete or change them, so a compromised host has no way to wipe or encrypt your backup history. The maintenance endpoint has full access and its own key, and it is where forget and prune run.

Create the maintenance key from your vault in the portal (Maintenance key). It is shown once. Run retention from one trusted machine, never from the hosts you back up:

restic -r rest:https://maint:<maintenance-key>@<vault-id>-maint.vault.servercrate.net/ \
  forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune

Your repository password is the same on both endpoints. The maintenance key only controls who is allowed to delete.

Running prune on a schedule

Run forget on a schedule so your repository stays clean automatically. On ServerCrate, schedule it on the trusted machine that holds your maintenance key, not in the backup script on each host. Separate prune jobs are only needed if you want to defer the I/O cost of cleanup.

restic backup /etc /var/www /home --tag daily
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --tag daily --prune
restic check

Storage cost estimates

With deduplication, the actual storage of a daily backup policy depends on your change rate. For a typical server with 50GB of data and a 5% daily change rate, 7 daily + 4 weekly snapshots uses roughly 60-80GB. ServerCrate's 250 GB Starter plan at $3/month covers most single-server setups cleanly.

Retention by plan on ServerCrate

ServerCrate enforces a maximum snapshot retention window per plan - 7 days on Free, 14 days on Lite, 30 days on Starter, 60 days on Standard, 90 days on Pro and 180 days on Business. Your restic forget policy should be set to not exceed these windows, or older snapshots will still count against your storage quota without being accessible from the portal.

Align your forget policy with your plan. For a Standard plan (60-day retention), a policy of --keep-daily 7 --keep-weekly 8 --keep-monthly 2 gives you 8 weeks of weekly snapshots plus 2 monthly snapshots - all within the 60-day window.

The difference between forget and prune

This trips up many users. restic forget removes snapshot references from the repository index. But the actual data blocks those snapshots referenced are still physically present in the pack files. Storage is not reclaimed until you run restic prune.

Running restic forget --prune does both in one command. Running restic forget alone is useful if you want to defer the I/O cost of prune to off-peak hours, or if you want to inspect what would be deleted before committing. In practice for most setups, just always pass --prune to forget.

Restic forget with multiple hosts in one repository

If you back up multiple machines to a single ServerCrate vault - which Standard and Pro plans support - always scope your forget commands by host or tag. Without scoping, forget applies across all snapshots in the repository and may prune snapshots from other machines.

# Safe: scoped to this host only
restic forget --keep-daily 7 --keep-weekly 4 --host $(hostname) --prune

# Dangerous: applies to ALL hosts in the repository
restic forget --keep-daily 7 --keep-weekly 4 --prune

Tag each machine's backups on creation with --tag $(hostname) and then target forget with --tag $(hostname) to keep host-level policies separate and predictable.

Try it live: the free retention calculator shows every restore point your keep rules leave you, and the vault size they cost.