my Files look like this:

# /etc/systemd/system/restic-backup.service

[Unit]
Description=Generate a restic backup snapshot
After=network.target

[Service]
Type=oneshot
WorkingDirectory=/
EnvironmentFile=/etc/restic-env
PassEnvironment=AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY RESTIC_REPOSITORY RESTIC_PASSWORD_FILE
Environment=XDG_CACHE_HOME=/var/cache
ExecStart=/usr/bin/restic backup -r s3:https://s3.us-west-004.backblazeb2.com/XXXBUCKETNAMEXXX /home/XXXX /etc /media/nathan/Storage --tag auto
ExecStart=/usr/bin/restic forget --prune --keep-hourly 6 --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --tag auto
ExecStart=/usr/bin/restic check --read-data

Nice=19
IOSchedulingClass=best-effort 
IOSchedulingPriority=7
TimeoutSec=3600
Restart=no

[Install]
WantedBy=multi-user.target

# /etc/restic-env

export AWS_ACCESS_KEY_ID=004XXXXXXXXXXXXXX
export AWS_SECRET_ACCESS_KEY=K00XXXXXXXXXXXXXXXXXXXXXXXX
export RESTIC_REPOSITORY=s3:s3.us-west-004.backblazeb2.com
export RESTIC_PASSWORD_FILE=/etc/restic-password

DEBUG_LOG=restic.log

I’m running the systemd commands from a root terminal and the permissions on restic-env and restic-password are 007