Appearance

How to back up your VPS with restic to S3 storage ​

DataPasa VPS plans do not include automatic backups or snapshots. Your data is on the server's NVMe disk and nowhere else, so backups are your job. The good news is that a solid setup takes about 20 minutes. This guide uses restic, a free open source backup tool that encrypts everything on your server before upload, deduplicates data between runs and works with any S3-compatible object storage.

How it works ​

  • restic stores backups in a repository, here a bucket in S3-compatible storage from any provider you like.
  • Every run creates a snapshot. Unchanged files are not uploaded again, so daily backups are small and fast.
  • Data is encrypted with a password that only you know. The storage provider sees only encrypted blobs.
  • A systemd timer runs the backup every night and removes old snapshots by a retention policy.

Keep the bucket with a different provider than the server. A backup that lives next to the original does not help when the original is gone.

Step 1. Create a bucket and access keys ​

In your object storage provider's console:

  1. Create a new private bucket, for example vps-backups.
  2. Create an access key limited to this bucket if the provider supports it.
  3. Note the endpoint URL, the access key ID and the secret access key.

Step 2. Install restic ​

On Ubuntu or Debian restic is in the standard repositories:

bash
apt update
apt install -y restic
restic version

Step 3. Store the credentials ​

Keep the settings in a root only folder:

bash
mkdir -p /etc/restic
chmod 700 /etc/restic
openssl rand -base64 32 > /etc/restic/password
chmod 600 /etc/restic/password
nano /etc/restic/env

Put this into /etc/restic/env, with your own values:

ini
RESTIC_REPOSITORY=s3:https://YOUR_S3_ENDPOINT/vps-backups
RESTIC_PASSWORD_FILE=/etc/restic/password
AWS_ACCESS_KEY_ID=YOUR_ACCESS_KEY_ID
AWS_SECRET_ACCESS_KEY=YOUR_SECRET_ACCESS_KEY

For S3-compatible services restic expects the format s3:https://server/bucket_name. If your provider needs a specific region, add AWS_DEFAULT_REGION=... as well.

bash
chmod 600 /etc/restic/env

Save the repository password elsewhere

Without /etc/restic/password nobody can decrypt the backups, including you. If the server disappears, the password disappears with it. Copy it now into your password manager.

Step 4. Initialize the repository ​

Load the variables into your shell and create the repository:

bash
set -a; . /etc/restic/env; set +a
restic init

restic answers created restic repository ... at s3:....

Step 5. Run the first backup ​

Choose what to back up. Typical paths are configuration, home folders and web data:

bash
restic backup --one-file-system --exclude-caches /etc /root /home /var/www
restic snapshots

Only list paths that exist on your server. If a path is missing, restic warns and marks the snapshot as incomplete.

Databases need a dump

Copying the files of a running MySQL or PostgreSQL database can give you a broken copy. Dump the database to a file first, for example with mysqldump or pg_dump into /var/backups, and back up that folder. The same applies to databases inside Docker containers.

Step 6. Automate with a systemd timer ​

Create the service /etc/systemd/system/restic-backup.service:

ini
[Unit]
Description=restic backup
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/env
ExecStart=/usr/bin/restic backup --one-file-system --exclude-caches /etc /root /home /var/www
ExecStart=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune
Nice=10
IOSchedulingClass=idle

The second command keeps 7 daily, 4 weekly and 6 monthly snapshots and deletes the rest from the bucket.

Create the timer /etc/systemd/system/restic-backup.timer:

ini
[Unit]
Description=Nightly restic backup

[Timer]
OnCalendar=*-*-* 03:00:00
RandomizedDelaySec=30m
Persistent=true

[Install]
WantedBy=timers.target

Persistent=true runs a missed backup as soon as the server is up again. Enable the timer and trigger one run by hand:

bash
systemctl daemon-reload
systemctl enable --now restic-backup.timer
systemctl start restic-backup.service
journalctl -u restic-backup.service -n 50
systemctl list-timers restic-backup.timer

Step 7. Test a restore ​

A backup you have never restored is a hope, not a backup. Restore the latest snapshot into a temporary folder and look at the files:

bash
set -a; . /etc/restic/env; set +a
restic restore latest --target /tmp/restore-test --include /etc/ssh
ls -la /tmp/restore-test/etc/ssh
rm -rf /tmp/restore-test

Once a month, run an integrity check of the repository:

bash
restic check

To recover onto a brand new server, install restic there, copy /etc/restic/env and the password from your password manager, and run restic restore latest --target /, or restore selected paths only.

Keep your balance topped up ​

Backups protect against mistakes and failures, but the most common reason to lose a VPS is simpler: the balance runs out. DataPasa bills servers by the hour from a prepaid balance. When it reaches zero, the server is suspended and, 24 hours later, deleted together with its disk and IP addresses. A deleted disk cannot be restored.

  • We send a low balance email when the balance drops below 30% of the monthly cost of your active servers. Make sure it does not land in spam.
  • Top up ahead of time, see how to top up your balance, and read how hourly billing works.
  • With off-site restic backups, even a deleted server can be rebuilt on a new VPS in minutes.

Summary ​

restic now encrypts and uploads your important files every night, keeps a sensible history and cleans up after itself. Check journalctl -u restic-backup.service from time to time, test a restore now and then, and keep the repository password outside the server.