rmnt

An ncdu-style TUI for browsing, dumping and restoring restic backups stored on S3 (Scaleway, AWS, Wasabi…).

Origin

rmnt started from a simple frustration: restic is a great backup tool, but day-to-day usage — browsing a snapshot, pulling a single file, restoring a folder — required remembering long commands and managing credentials carefully. The existing shell scripts worked, but they were fragile and had no real navigation.

This project was built entirely with Claude Code, which handled the bulk of the Go implementation — from the encrypted config layer to the Bubble Tea TUI — based on a plain-language description of the problem.

┌─ rmnt ──────────────────────────────────────────────────────┐
│ rmnt  6d0fa416  /home/user/sites/myrole                     │
│                                                             │
│   db/                                                       │
│ ▶ app.sql                                    35.9MiB        │
│   uploads/                                                  │
│   .env                                         1.2KiB       │
│                                                             │
│ ↑/↓ · → open · ← back · d dump · o→file · R restore        │
└─────────────────────────────────────────────────────────────┘

Installation

macOS — Homebrew

brew tap frulko/rmnt
brew install rmnt

Curl (macOS & Linux)

curl -fsSL https://raw.githubusercontent.com/Frulko/rmnt/main/install.sh | bash

Also installs restic if not already present.

Manual

Download the binary from GitHub releases and place it in /usr/local/bin.

Requirements

• restic — installed by the script or brew install restic
• macOS: macFUSE only required for the m (FUSE mount) command — brew install --cask macfuse
• Linux: libsecret for Keychain support (apt install libsecret-tools); passphrase fallback used if unavailable

Usage

rmnt

On first launch, a setup wizard prompts for profile name, S3 bucket and credentials.
Sensitive credentials are stored in the macOS Keychain or in an AES-256-GCM encrypted file (passphrase fallback).

Keyboard shortcuts

Profile list

Key	Action
↑/↓	Navigate
enter	Open profile
n	New profile
d	Delete profile
q	Quit

Snapshots

Key	Action
↑/↓	Navigate
enter / →	Open snapshot
r	Refresh
p	Back to profiles
q	Quit

File tree

Key	Action
↑/↓ j/k	Navigate
→ / enter / l	Enter directory / open file
← / h / esc	Go up
d	Dump file content to terminal
o	Dump file to a local path (tab to autocomplete)
R	Restore file or entire directory
/	Filter
m	Mount snapshot via FUSE (~/restic-backup)
u	Unmount
p	Back to profiles
q	Quit

Config files

~/.config/rmnt/profiles.json    # non-sensitive settings (bucket, endpoint…)
~/.config/rmnt/last_used        # last selected profile
~/.config/rmnt/last_output_dir  # last output directory (o command)
~/.config/rmnt/profiles.enc     # encrypted secrets (passphrase fallback only)
macOS Keychain                  # service "rmnt" (primary on macOS)

Build

make build    # → ./bin/rmnt
make install  # → ~/go/bin/rmnt
make test

Security

• Credentials are never passed as command-line arguments (env only)
• restic is invoked directly, never via sh -c
• The restic password is always prompted at launch, even if stored
• Encrypted file format: Argon2id (t=3, m=64MiB) + AES-256-GCM

Credits

TUI built with the excellent open-source libraries from Charm:

• Bubble Tea — Elm-architecture TUI framework for Go
• Bubbles — TUI components (list, textinput, spinner, viewport)
• Lip Gloss — terminal styling and layout