Restic Snapshot Groups, AKA "Why isn't restic forgetting my snapshots?"

I use restic to manage backups on my machines, and not too long ago I ran into some surprising behavior that I thought I'd share.

One significant aspect of the restic configuration for my work laptop is that I periodically expire old backups, since I have a limited amount of storage due to a need to keep all work stuff on company hardware. Specifically, my daily backups for the work monorepo are expired after one month, whereas my "everything else" backups are expired after six months using restic forget --tag=no-monorepo --keep-within=6m along with restic prune.

Anyway, one day I noticed (because I do this by hand 😅) that a handful of old backups - like 18 months old - were not getting picked up by restic forget --tag=no-monorepo --keep-within=6m! I suspected some restic bug, so I started to dig in - but it turns out that I was actually running into some expected behavior!

You see, in December 2023, I noticed that I wasn't backing up /etc. In the past, backing up /etc has gotten me out of trouble a number of times, so I added /etc to the list of covered directories in my daily backup job and went on with my life. But it turns out that when you run restic forget with a flag like --keep-within, it does two things I wasn't aware of before: first, it collects backups into snapshot groups ("snapshot" being restic's preferred term for a backup), and by default it groups by the host and the paths a backup was made against. So all of those pre-December 2023 backups I had were being grouped separately from my more recent backups - but they're still older than six months, right?

...which brings me to the second thing restic forget does that surprised me - when deciding whether or not it should forget a snapshot, restic considers that snapshot's timestamp against the latest snapshot in its group, rather than the current time! So all I had to do was use --group-by=host with restic forget, and that took care of the older snapshots.