The “1” in the 3-2-1 backup rule is one copy off-site. A VPS with plenty of storage makes an excellent off-site backup target for your other servers, your office NAS, or your laptops. You control the software, encryption and retention, and there are no per-request fees as with some object storage services.

Background: the 3-2-1 backup rule.

Choose the server

  • Storage first: size for your data × retention, plus growth. Deduplicating tools (restic, Borg) store many versions efficiently, often only 1.2–2× the source size for months of history.
  • A different location from the servers being backed up (another city or region).
  • Bandwidth: the first full backup is large, and later backups only send changes.
  • VPS.DO offers Storage VPS plans with 500 GB of SSD storage in the USA and Hong Kong. See storage VPS.

Option 1: restic over SFTP

restic encrypts, deduplicates and compresses backups, and can use a plain SFTP server as the repository.

On the backup VPS, create a dedicated user:

sudo adduser --disabled-password --gecos "" backup
sudo -u backup mkdir -p /home/backup/repos
# add the client's public SSH key to /home/backup/.ssh/authorized_keys

On each client:

sudo apt install -y restic
export RESTIC_REPOSITORY="sftp:[email protected]:/home/backup/repos/web1"
export RESTIC_PASSWORD_FILE=/root/.restic-pass        # store this password safely elsewhere too!
restic init
restic backup /etc /var/www /var/backups/db --exclude-caches
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
restic check

Schedule it with cron or a systemd timer. See crontab.

restic’s REST server in append-only mode (rest-server --append-only) is even better: clients can add backups but not delete them. That protects your history if a client server is compromised, and an attacker tries to wipe backups.

Option 2: BorgBackup

Borg is similar (dedup, compression, encryption), and needs borg installed on both ends. Restrict each client’s SSH key to its own repository in append-only mode:

# /home/backup/.ssh/authorized_keys on the backup VPS
command="borg serve --append-only --restrict-to-path /home/backup/repos/web1",restrict ssh-ed25519 AAAA... root@web1

Clients then run borg create, and pruning is done from a trusted machine (or the backup server) with full access.

Option 3: rsync snapshots

For simple file copies with history, use rsync --link-dest to create daily snapshots that hard-link unchanged files:

rsync -a --delete --link-dest=/srv/backups/web1/latest root@web1:/var/www/ /srv/backups/web1/$(date +%F)/
ln -sfn /srv/backups/web1/$(date +%F) /srv/backups/web1/latest

This is pull-based: the backup server connects to clients, so clients can’t touch old backups. It’s not encrypted at rest, though. Use disk encryption, or restic/Borg for sensitive data. See rsync examples.

Security of the backup server

  • SSH keys only, a firewall that allows SSH only from your servers’ IPs, and Fail2ban. See Linux server hardening checklist.
  • Separate users or repositories per client, with restricted keys.
  • Append-only or pull-based designs, so a hacked client can’t delete history.
  • Encryption: restic and Borg encrypt client-side, so the backup server never sees plaintext. Keep the repository passwords outside the systems being backed up (in a password manager).
  • Monitor disk usage, and alert before it fills. See disk full troubleshooting.

Back up the backup server?

For critical data, add another copy: replicate repositories to object storage (rclone), or to a second backup VPS in another region. Make sure the replica can’t be deleted from the primary backup server.

Test restores regularly

restic snapshots
restic restore latest --target /tmp/restore-test --include /var/www/example.com

Schedule a restore drill every few months: restore a full server onto a test VPS, and check that the application runs. See database backup automation.

Quick reference

Tool Strengths
restic (SFTP or rest-server) Encrypted, dedup, many backends, append-only server
BorgBackup Encrypted, dedup, fast, append-only via SSH key restrictions
rsync --link-dest Simple, pull-based snapshots
Storage VPS 500 GB SSD in USA and HK

Related: Docker volume backups and off-site VPS backups.

  • Backup
  • VPS Guide
  • Storage