Encrypted backups of a VPS with restic: a first repository, a schedule, a test restore

The short answer: restic is a backup program that encrypts everything, stores only what changed since last time and lets you go back to any earlier day. It is for copying a VPS’s folders to another disk, another server or cloud storage. A backup is only worth something once you have seen a file restored from it.

Before you start

Decision In a few words
Where to keep it Off the VPS. A copy on the same disk is lost with it. See Off-site backups.
What to copy The site files, the settings in /etc and a database export, made beforehand. See Backing up with mysqldump and pg_dump.
The password It encrypts the backup. If you lose it, you lose the backups. Keep it in a password manager and somewhere else off the server.

Step by step

1 Install it: sudo apt install restic (Ubuntu and Debian). Confirm with restic version.
2 Keep the password in a file of its own: echo "A-LONG-PHRASE" | sudo tee /root/.restic-pass and then sudo chmod 600 /root/.restic-pass. Point to it with export RESTIC_PASSWORD_FILE=/root/.restic-pass.
3 Create the repository (once only). On a mounted disk or folder: restic init --repo /mnt/backups/restic. On another server over SFTP: restic init --repo sftp:user@server:/backups/restic. For an S3 bucket, restic has its own way of passing the credentials: see its documentation.
4 Make the first backup: restic -r /mnt/backups/restic backup /var/www /etc /root/exports. The following ones are much faster: only what changed goes.
5 See what exists: restic -r /mnt/backups/restic snapshots. Each line is a point in time you can return to.
6 Test the restore, into a test folder, never over what is in use: restic -r /mnt/backups/restic restore latest --target /tmp/restore. Open a file from there and confirm it is fine. See Testing a backup.

Making it run by itself

1 Write a small script with the database export, the restic backup line and the cleanup of old copies: restic -r /mnt/backups/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune. The numbers say how many daily, weekly and monthly copies to keep; choose your own. See How many backups to keep.
2 Schedule it with cron, at a quiet hour. See Cron jobs.
3 From time to time, run restic -r /mnt/backups/restic check for restic to verify the repository is intact.
Without a test restore you do not have a backup, you have a hope. And a copy on the same server does not protect you from losing it, from an attack or from a mistake. To decide between file copies and disk images, see Backing up a VPS: snapshots or files.

Want help deciding what to back up on your VPS and where to? Open a ticket describing what runs there.

Open a support ticket

SEE ALSO

Backing up a VPS: snapshots or files

Incremental backups: what they are and when a full copy is still needed

Off-site backups: sending a copy to cloud storage, an S3 bucket or Google Drive

Testing a backup: a restore drill on a test subdomain, step by step

RECOMMENDED PRODUCT

VPS server with root access

Resources of your own, the OS you choose, reinstall whenever you like. from KSh1,092.00/mo (3-year plan, with coupon)

See plans
  • 0 Users Found This Useful
Was this answer helpful?

Related Articles

How to migrate a site without downtime Changing hosting provider does not have to take your site offline. The trick is simple: set everything up here before po...
Internal migration: moving sites between plans Changing plan inside MozOut - from Hospedagem Pro to Plus, say - is far simpler than migrating from another provider. In...
How to generate zip and sql files to migrate a WordPress site A WordPress site is always two halves: the files (theme, plugins, images) and the database (posts, pages, settings). To...
How to restore your data with JetBackup Every account here is backed up automatically, once a day, in the early hours of the morning - the last 30 daily backups...
Making and keeping your own backup, and testing that it works Restoring a copy of ours is covered in how to restore your data with JetBackup. This article is about the other half, an...
A test site before touching what is live Half the broken sites we see broke the same way: somebody updated, installed or changed something on the live site, mid-...