Although restic is a really nice backup solution, it lacks the possibility to pull the files to backup from a remote server, like rsync does over ssh, preventing any attacker to gain access to a secret. This blog post shows some workarounds and does the backup to a QNAP NAS S3 store over an encrypted TLS connection.
Read more: https://harald.hoyer.xyz/restic/