Back up a VPS: a simple strategy

A backup that has never been restored is only a hypothesis. A copy exists only if you make it: a VPS alone does not protect your data. A simple strategy comes down to three ideas: a rule for copies, a tool that encrypts, and a regular restore test.

• The 3-2-1 rule: three copies, two media, one copy outside the VPS.
• restic or borg encrypt and deduplicate: the repository password must be kept outside the server.
• A backup that has not been restored is not proven: test the restore once a month.

The 3-2-1 rule

Three copies of your data, on at least two different media, one of them outside the VPS. This rule prevents a single failure, a manual mistake or an attack from erasing everything.

• Copy 1: the production data, on the VPS.
• Copy 2: a backup on another medium, for example remote storage reachable over SFTP or a disk on your PC.
• Copy 3: a second backup outside the VPS, ideally with another provider or in another place.

Choose the tool: restic or borg

restic and borg create encrypted, deduplicated and incremental backups: only the changed blocks are sent. They can write to SFTP, S3 or a local disk. Both are free software and install easily on Debian or Ubuntu.

• sudo apt install -y restic
• export RESTIC_REPOSITORY=sftp:[email protected]:/srv/restic: the repository address, to adapt to your storage space.
• restic init creates the repository only once. The encryption password must be stored outside the VPS.

Schedule, prune and test

A scheduled backup runs without you. You also need to limit the number of versions kept, so the storage does not fill up, and to check the repository from time to time. The database must be exported before the files are copied, so that it stays consistent.

• mysqldump wp_exemple > /root/base.sql, then restic backup /root/base.sql /var/www: a script run every night by cron or a systemd timer.
• restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune: keeps 7 daily, 4 weekly and 6 monthly versions.
• restic restore latest --target /root/restore-test, then compare the files. One test a month is enough to spot the gaps.