Resticpal runs restic backups on a schedule, with a Windows service, tray icon and settings window. It supports personal PCs, small fleets and managed deployments, using restic’s repository formats and storage backends.

Backups on a laptop

Laptops sleep, disconnect and switch networks. Resticpal accounts for that when scheduling backups:

  • Sleeping Laptops: Backups automatically catch up after a machine wakes up, respecting a configurable grace period before starting.
  • Power and Network Gates: The scheduler monitors battery state and metered-network status to delay resource-heavy uploads according to your power and network settings.
  • Windows Wake Locks: The background service holds a bounded Windows wake lock while active to prevent the machine from falling asleep mid-backup, with a hard two-hour safety timeout.

Running in the background

Resticpal operates as a machine-wide LocalSystem Windows service. After setup, the service runs backups on schedule even when you close the settings window or sign out.

A small Win32 tray app starts when you sign in. It shows backup status and progress, opens settings, and lets you start or cancel a backup.

Three deployment modes

Choose how each PC gets its backup settings:

  1. Standalone Mode: Keeps all configuration and repository credentials encrypted locally on the PC using DPAPI-protected storage with restricted ACLs. This mode is completely self-contained and needs no account or server.
  2. Plain Manifest Mode: Periodically polls backup policies from a standard HTTP/HTTPS file server. The client only fetches the policy file: it does not identify the device, upload client status, or expose repository secrets.
  3. Managed Server Mode: Enrolls the device using a one-time signed bootstrap URL to fetch policies and report backup metrics. The client retains a signed local copy of the last-known-good policy for offline operation.

Ransomware-Conscious Append-Only Backups

In standard backup setups, a compromised client computer could access repository keys and delete historical archives. Resticpal mitigates this risk by enforcing a strict append-only model:

  • Client Limitation: The local client builder restricts execution to append-only commands, allowing it to write new snapshots but denying it the authority to run retention prunes, rewrites, or key deletions.
  • Companion Server: A companion resticpal-server holds the full-access repository credentials securely. It runs retention and data-pruning tasks on a separate schedule on a different host. The server never sends full-access credentials to enrolled backup clients.

Development and Installation

Resticpal is an open-source project licensed under the BSD 2-Clause License. The scheduler, named-pipe IPC and Windows service use Rust. The interface uses C# with .NET SDK 10 and WinUI 3, and WiX 6 builds the MSI installer.

The per-machine MSI installs the backup service, sets its recovery policies and adds the notification tray for all users. StackFoundry LLC signs the executables and MSI with its Authenticode certificate.

The source code and documentation are available on GitHub.