Back Up Your VPS with Restic to Another Server

A backup that lives on the same server as your data is not a real backup: if the server fails or is deleted, both are gone. Restic is a free tool that makes encrypted, space-saving backups and sends them to another place, such as another server over SFTP, or S3-compatible storage. This guide uses SFTP to a second server you control.

Before you start, connect to your VPS with SSH. You also need somewhere else to store the backups and an SSH login for it.

1. Install restic

sudo apt update && sudo apt install -y restic
restic version

2. Prepare the backup place

On the storage server, create a folder for the backups, for example /backups/myvps. From your VPS, make sure you can log in to it with an SSH key without a password:

ssh-keygen -t ed25519 -f ~/.ssh/backup_key -N ""
ssh-copy-id -i ~/.ssh/backup_key.pub backupuser@STORAGE_HOST

3. Create the repository and a password

The password encrypts your backups. Store it somewhere safe that is not on this server too: without it the backups cannot be opened.

sudo mkdir -p /root/.restic && sudo sh -c 'openssl rand -base64 32 > /root/.restic/pass && chmod 600 /root/.restic/pass'
export RESTIC_REPOSITORY="sftp:backupuser@STORAGE_HOST:/backups/myvps"
export RESTIC_PASSWORD_FILE=/root/.restic/pass
sudo -E restic init

Copy the password out with sudo cat /root/.restic/pass and keep it in your password manager.

4. Run the first backup

Choose what matters: website files, uploads, configuration and a database dump (not the live database folder).

sudo mysqldump --single-transaction --all-databases > /root/db.sql
sudo -E restic backup /var/www /etc /root/db.sql
sudo -E restic snapshots

5. Run it every day

Create /usr/local/bin/backup.sh:

#!/bin/bash
export RESTIC_REPOSITORY="sftp:backupuser@STORAGE_HOST:/backups/myvps"
export RESTIC_PASSWORD_FILE=/root/.restic/pass
mysqldump --single-transaction --all-databases > /root/db.sql
restic backup /var/www /etc /root/db.sql
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Then make it run at 02:30 every night:

sudo chmod 700 /usr/local/bin/backup.sh
echo '30 2 * * * root /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1' | sudo tee /etc/cron.d/backup

6. Test a restore (do not skip this)

sudo -E restic restore latest --target /tmp/restore-test --include /etc/hostname
cat /tmp/restore-test/etc/hostname

If the file comes back, your backups work. Repeat this test every few months.

Good to know

A backup you have never restored is only a hope. Put the restore test in your calendar.
Keep at least one copy somewhere that your server's login cannot delete.

Run it on your own VPS

Cloud VPS plans: Run your backups on a server you control. Prices are in rupees, you can pay by UPI, and you get a GST invoice.