Three restic repositories, one password

For a long time my backups went to exactly one place. That place was fine until the week it wasn't, and I spent an evening wondering how much of my photo library I was willing to lose. The answer was none of it, so now every job writes to three repositories.

The layout

Each host runs resticprofile from a systemd timer. A profile has one source and three targets: an S3 bucket, Google Drive through rclone, and a small Garage instance at my parents' place.

[Timer]
OnCalendar=*-*-* 03:30
RandomizedDelaySec=20m
Persistent=true

All three repositories share one password. That sounds worse than it is: the password lives in a password manager, and losing it would hurt equally no matter how many copies of it existed.

Pruning without stepping on each other

Every job forgets only its own host and tag. Pruning and checking run once a week from a single machine, so two hosts never fight over the same lock.

What I'd do differently

Test restores earlier. A backup you have never restored from is a hypothesis, not a backup.