Your Repository Password

This page explains the restic repository password that protects every snapshot in one destination.

What it protects

The repository password encrypts everything in the restic repository. Without it, the repository cannot be read or restored.

Vecta never receives this password. It stays on the agent machine with the destination credentials.

Save it during setup

When you run vecta-agent setup <JOB_ID> for a new repository, the agent generates a password and prints it once. Setup pauses until you acknowledge that you saved it by typing SAVED.

Warning

Save the password before allowing setup to continue. If you lose it, the repository is permanently unreadable. There is no Vecta reset, recovery, or escrow for a restic repository password.

Use a password manager as the primary copy. If you choose to supply the password through RESTIC_PASSWORD, a password file, or ~/.config/vecta/restic.env, you are responsible for protecting and backing up that secret.

One password per repository

Each repository has its own password. Multiple destinations therefore mean multiple passwords. Losing one password does not affect the other repositories, but it does make that one repository unreadable.

What's next

Continue with Getting Started, or read Restoring Data to see where the password is needed.