Backing up your site with restic or borg

A backup only truly exists if it is somewhere else, encrypted, and tested. A site duplicated on the same server does not survive a hardware failure or a fat-fingered command. Two free tools dominate client-side backup: restic and borg. Both encrypt before sending, deduplicate to save space, and keep versions so you can travel back in time.

restic or borg: which to choose

• restic: simple, cross-platform, a single binary, writes to SFTP, S3 or a local repository. Perfect to start with.
• borg (BorgBackup): very efficient compression and deduplication, ideal over SSH to remote storage. A notch more technical, but formidable on large volumes.

Both encrypt end-to-end: the key stays with you, and the host cannot read your data. That is exactly the model of our storage plan — we provide the space, you keep control.

What to back up

For a typical site, three things:

• The files: code, media, uploads (wp-content/uploads for WordPress).
• The database: export it first (mysqldump or pg_dump) to a file, then include that file in the backup. Never back up the raw files of a database that is being written to.
• The configuration: server files, certificates, environment variables.

An example with restic

From your server, pointing at our storage over SFTP:

export RESTIC_PASSWORD='your-secret-passphrase'
restic -r sftp:user@storage:/backups init
restic -r sftp:user@storage:/backups backup /var/www /root/dump.sql
restic -r sftp:user@storage:/backups forget --keep-daily 7 --keep-weekly 4 --prune

The last line applies a retention policy: seven daily backups, four weekly, the rest is pruned. Automate the whole thing with a cron job or a systemd timer.

The 3-2-1 rule

Keep three copies of your data, on two different media, with one off-site. Your server counts as one copy; encrypted remote storage like ours provides the off-site copy. And above all: test your restores regularly. A backup that has never been restored is a hypothesis, not a guarantee.

Our storage

Our 1 TB storage is reachable over SFTP, rsync, restic, borg, WebDAV and Samba, with snapshots and unlimited traffic. You encrypt client-side: we cannot read your data, and we do not want to. No commitment, payable by card or in cryptocurrency.