Powershell script to automate Restic & Windows VSS - found: https://github.com/restic/restic/issues/340 by https://github.com/turnkey-commerce

restic-backup-windows-vss.ps1

# Windows PowerShell Script to use restic to backup files using the Volume Shadow Copy Service, allowing files
# that are in use to be backed up. The script must be run with elevated privileges.
# The Volume Shadow Copy Service must be enabled for the disk volume that contains the folders/files to be backed up.
#
# Adapted from https://gist.github.com/adejones/1c185b057b51ddfa2b837183409a7821

# Parameters
$hostName = "HAL"
$resticExe = "C:\ProgramData\chocolatey\bin\restic.exe"
# Reminder of the format for Backblaze repos:
# "b2:my-bucket:my-repo", where "my-bucket" is the name of the bucket and "my-repo" is the name of the repo
$resticRepository = "D:\restic\repo1"
$rootVolume = "C:\"
$tag = "My backup job 1"
$fromFileName = "backup_job_1_include.txt"
$excludeFileName = "backup_job_1_exclude.txt"

# List of folders or files to back up, separated by commas. Remove the initial 'C:\'
$foldersToBackup = @(
    'Users\Username\AppData\Local\Microsoft\Outlook', 
    'Users\Username\AppData\Local\Microsoft\Microsoft SQL Server Local DB'
)

# List of patterns to exclude, separated by commas
$excludePatterns = @(
    "*.go",
    "*.mp4"
)

# Your Restic password should be available in the RESTIC_PASSWORD environment variable.
# If not, uncomment the following line with the actual password. In that case, make sure to stringently restrict
# access rights to the present script.
#$env:RESTIC_PASSWORD = "secret_password"

# If using Backblaze cloud storage, your application-key id and secret should be available
# in the B2_ACCOUNT_ID and B2_ACCOUNT_KEY environment variables.
# If not, uncomment the following lines with the actual values.  In that case, make sure to stringently restrict
# access rights to the present script.
#$env:B2_ACCOUNT_ID = "application_key_id"
#$env:B2_ACCOUNT_KEY = "application_key_secret"

###### No need to modify anything below this line ######
$shadowPath = $rootVolume + 'shadowcopy\'

# Create a volume shadow copy and make it accessible
$s1 = (Get-WmiObject -List Win32_ShadowCopy).Create($rootVolume, 'ClientAccessible')
$s2 = Get-WmiObject Win32_ShadowCopy | Where-Object { $_.ID -eq $s1.ShadowID }
$device  = $s2.DeviceObject + '\'

# Create a symbolic link to the shadow copy
cmd /c mklink /d $shadowPath "$device"

# Write to a temp file the shadow paths of folders/files to back up
$fromFile = $env:TEMP + '\' + $fromFileName
$stream = [System.IO.StreamWriter] $fromFile
$foldersToBackup | ForEach-Object {
    $stream.WriteLine($shadowPath + $_)
}
$stream.close()

# Write exclude patterns to another temp file
$excludeFile = $env:TEMP + '\' + $excludeFileName
$stream = [System.IO.StreamWriter] $excludeFile
$excludePatterns | ForEach-Object {
    $stream.WriteLine($_)
}
$stream.close()

# Run Restic
cmd /c $resticExe -r $resticRepository backup --tag "$tag" --host "$hostName" --files-from "$fromFile" --exclude-file "$excludeFile"

# Remove temp files
Remove-Item $fromFile
Remove-Item $excludeFile

# Delete the shadow copy and remove the symbolic link
$s2.Delete()
cmd /c rmdir $shadowPath

# Automatically remove obsolete snapshots
cmd /c $resticExe -r $resticRepository forget --tag "$tag" --host "$hostName" --keep-daily 7 --keep-weekly 5 --keep-monthly 12 --keep-yearly 75

Write-Output 'Done'