A backup you haven’t restored is a hope, not a plan. This guide sets up backups for a Debian server that you can actually recover from: the right data, stored off the server, encrypted, automated and tested.

Decide what you need to recover

Two numbers drive the plan:

  • RPO (Recovery Point Objective) — how much data you can afford to lose. Daily backups = up to 24 hours.
  • RTO (Recovery Time Objective) — how quickly you need to be back online.

A blog may accept a daily backup and a few hours to restore. A shop needs more frequent database backups and a faster path.

What to back up

Data Location (typical)
Website and application files /var/www, /srv, /opt/app
Databases (as dumps) MariaDB / PostgreSQL
Configuration /etc (nginx, php, ssh, cron, systemd units)
Docker volumes /var/lib/docker/volumes (stop or dump first)
Home directories, scripts /home, /root
Package list dpkg --get-selections

You don’t need to back up the OS itself — reinstalling Debian is faster than restoring it. Back up the data and configuration that make your server unique.

The 3-2-1 rule

  • 3 copies of your data,
  • on 2 different types of storage,
  • 1 off-site.

A backup on the same server protects against mistakes, not against losing the server. Always keep at least one copy elsewhere — another server or object storage.

Step 1: Dump databases consistently

Copying live database files gives inconsistent backups. Dump them first:

mkdir -p /var/backups/db

# MariaDB / MySQL
mariadb-dump --all-databases --single-transaction --routines --events \
  | gzip > /var/backups/db/mariadb-$(date +%F).sql.gz

# PostgreSQL
sudo -u postgres pg_dumpall | gzip > /var/backups/db/postgres-$(date +%F).sql.gz

find /var/backups/db -name '*.sql.gz' -mtime +7 -delete

Step 2: Encrypted off-site backups with restic

restic deduplicates, compresses and encrypts backups, and supports SFTP, S3-compatible storage and more.

apt install -y restic
export RESTIC_REPOSITORY=sftp:[email protected]:/srv/restic/web1
export RESTIC_PASSWORD_FILE=/root/.restic-pass     # store the password safely elsewhere too!
restic init
restic backup /etc /var/www /var/backups/db /root --exclude-caches
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Use an S3-compatible bucket instead with RESTIC_REPOSITORY=s3:https://s3.example.com/bucket/web1 and access keys in environment variables.

Lose the restic password and the backups are useless. Keep it in a password manager.

Step 3: Automate with a systemd timer

# /etc/systemd/system/backup.service
[Service]
Type=oneshot
EnvironmentFile=/root/.backup.env
ExecStart=/usr/local/bin/backup.sh
# /etc/systemd/system/backup.timer
[Timer]
OnCalendar=*-*-* 03:15
Persistent=true
RandomizedDelaySec=15m

[Install]
WantedBy=timers.target
systemctl daemon-reload
systemctl enable --now backup.timer
systemctl list-timers backup.timer

backup.sh runs the database dumps, then restic backup and restic forget --prune. Send yourself an alert on failure — e.g. a health-check URL (Healthchecks.io or a self-hosted equivalent) pinged at the end of a successful run.

Step 4: Test restores

Schedule a restore test at least monthly:

restic snapshots
restic restore latest --target /tmp/restore-test --include /var/www
restic check

Once in a while, practise a full recovery on a fresh VPS: install Debian, install packages, restore /etc selectively, restore files, import database dumps, switch DNS. Time it — that’s your real RTO.

Disaster recovery runbook

Write down, somewhere other than the server:

  1. Where backups are and how to access them (credentials in your password manager).
  2. The list of packages and services the server runs.
  3. Restore steps in order, and DNS records to update.
  4. Who to contact (your provider’s support, your team).

Summary

Back up data and configuration rather than the whole OS, keep an encrypted off-site copy, automate it, monitor it and test restores. For general cloud backup options, see backing up a VPS to the cloud and automated VPS backups. A second small VPS in another location makes an inexpensive backup target — our Storage VPS plans include large SSD disks for exactly this.

  • Debian
  • Backups
  • Linux