Setup & operation

How do I back up a VPS properly?

Short answer

Follow the 3-2-1 rule: three copies, on two kinds of media, one off-site. In practice that means snapshots for quick rollback, plus an encrypted nightly backup with restic or Borg to a different jurisdiction, plus a restore you have actually tested. An untested backup is a hypothesis.

Back up the data, not the machine. Databases need a proper dump or a filesystem-consistent snapshot, not a naive file copy of a running data directory, which produces a corrupt copy that appears to succeed.

Encrypt before the data leaves the instance. restic and Borg both encrypt client-side, so the backup target — including ours — never sees plaintext.

  • restic backup /srv --repo sftp:backup-host:/repo, with a password file
  • Dump databases first: pg_dump or mariabackup, then back up the dump
  • Keep at least one copy in a different jurisdiction
  • Schedule a restore test quarterly and put it in a calendar

See also: Snapshot