Back up your Linux VPS with rsync, restic and cron

A backup only counts if it lives somewhere other than the server and you have restored from it at least once. This guide builds a simple, dependable routine.

1. Decide what to back up

• Website and app files, for example /var/www, /srv and /home.
• Configuration in /etc (Nginx, SSH, cron files).
• Database dumps, not the live database files.
• Anything else you could not quickly recreate: TLS keys, .env files, uploads.

2. Dump databases first

Copying /var/lib/mysql while the database runs gives an inconsistent copy. Dump to a file instead:

sudo mkdir -p /var/backups/db
sudo mariadb-dump --single-transaction --all-databases | gzip | sudo tee /var/backups/db/mariadb.sql.gz > /dev/null
sudo -u postgres pg_dumpall | gzip | sudo tee /var/backups/db/postgres.sql.gz > /dev/null

Keep only the line for the database you use.

3. Option A: pull a copy with rsync

Run this on your own computer or a backup server, so the VPS never holds credentials to your backups:

rsync -az --delete alex@203.0.113.25:/var/www/ ~/backups/myvps/www/

4. Option B: encrypted, versioned backups with restic

restic stores deduplicated, encrypted snapshots on SFTP, S3-compatible storage and more. Install it:

sudo apt install -y restic                                   # Ubuntu / Debian
sudo dnf install -y epel-release && sudo dnf install -y restic   # AlmaLinux / Rocky

Create a password file and initialise a repository (here over SFTP to another server you control):

sudo sh -c 'openssl rand -base64 32 > /root/.restic-pass && chmod 600 /root/.restic-pass'
sudo restic -r sftp:backup@backup.example.com:/srv/restic/myvps --password-file /root/.restic-pass init

5. Automate it

Create /usr/local/bin/backup.sh:

#!/usr/bin/env bash
set -euo pipefail
export RESTIC_REPOSITORY="sftp:backup@backup.example.com:/srv/restic/myvps"
export RESTIC_PASSWORD_FILE="/root/.restic-pass"

mariadb-dump --single-transaction --all-databases | gzip > /var/backups/db/mariadb.sql.gz
restic backup /etc /var/www /home /var/backups/db
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Make it executable and schedule it nightly in root's crontab (sudo crontab -e):

sudo chmod 700 /usr/local/bin/backup.sh

30 2 * * * /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1

6. Test a restore

sudo restic -r sftp:backup@backup.example.com:/srv/restic/myvps --password-file /root/.restic-pass snapshots
sudo restic -r sftp:backup@backup.example.com:/srv/restic/myvps --password-file /root/.restic-pass restore latest --target /tmp/restore-test

Check a few files in /tmp/restore-test, then delete it. Repeat this every few months.

Troubleshooting

• SFTP repository asks for a password: restic needs key-based SSH from root to the backup host. Add root's public key there.
• Cron job does nothing: read /var/log/backup.log. Cron's PATH is minimal, so use full paths if a command is not found.
• Backups use too much space: check the forget rules and run restic stats.

Next steps

• Schedule tasks with cron