🚀 Off-site Backups with restic on a VPS — Encrypted, Scriptable

Daily snapshots from your host are insurance against mistakes, not against losing the whole host. Real backups live somewhere else and are encrypted. restic does both, and it is one binary.

1. Install restic

apt update && apt install -y restic

restic writes a single encrypted repository. It can live on S3, Backblaze B2, another server over SFTP, or even a second Buran VPS.

2. Create the repository

export RESTIC_REPOSITORY="sftp:backup@other-host:/srv/backups/myserver"
export RESTIC_PASSWORD="a-long-unique-passphrase"
restic init

Keep the passphrase in a password manager. If you lose it, the data is gone — that is the point of encryption. For automatic jobs, store it in an environment file readable only by root:

cat > /etc/restic.env <<'EOF'
RESTIC_REPOSITORY=sftp:backup@other-host:/srv/backups/myserver
RESTIC_PASSWORD=change-me
EOF
chmod 600 /etc/restic.env

3. First backup

set -a; . /etc/restic.env; set +a
restic backup /etc /root /home /var/www --exclude-caches
restic snapshots

Databases need a dump, not a file copy: a running PostgreSQL data directory is inconsistent. Dump first, then back up the dump folder. See our PostgreSQL guide for the dump command.

4. Run it nightly with a systemd timer

cat > /etc/systemd/system/restic-backup.service <<'EOF'
[Unit]
Description=restic backup
[Service]
Type=oneshot
EnvironmentFile=/etc/restic.env
ExecStart=/usr/bin/restic backup /etc /root /home /var/www --exclude-caches
ExecStartPost=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
EOF
cat > /etc/systemd/system/restic-backup.timer <<'EOF'
[Unit]
Description=Nightly restic backup
[Timer]
OnCalendar=*-*-* 03:30:00
Persistent=true
[Install]
WantedBy=timers.target
EOF
systemctl daemon-reload
systemctl enable --now restic-backup.timer

5. Test the restore — today, not in an emergency

set -a; . /etc/restic.env; set +a
restic snapshots
restic restore latest --target /tmp/restore-test
ls -la /tmp/restore-test/etc

A backup you have never restored is a hope, not a backup. Repeat the test every few months — and check that the repository actually grows.

Quick answers

Where should the backup repository live?

Anywhere except the machine you are backing up: object storage like Backblaze B2, another server over SFTP, or a second VPS. Backups on the same host do not survive a lost host.

How much space do I need?

restic deduplicates and compresses, so a typical server rarely grows more than a few GB per month of changes. 50–100 GB of remote storage is plenty for a small server.

Do I still need host snapshots?

Yes. Buran snapshots restore a whole machine in one click and are perfect for “I broke it five minutes ago”. Off-site restic backups cover hardware loss and operator mistakes that outlive the snapshot window.

Need a second machine to hold backups? A €3 NAT box works fine.

Encrypted off-site backups with restic