Why back up your VPS with BorgBackup
Borg takes deduplication to a remarkable level: it splits files into chunks with variable boundaries, which detects identical data even when it is shifted within a file. As a result, weeks of daily archives fit in a fraction of the space of a single full copy. To this are added configurable compression (lz4, zstd, zlib), authenticated encryption (the repository resists tampering, not just reading) and a robust repository format. Self-hosting Borg on the VPS, pushing archives to a remote repository (ideally a BorgBackup-compatible service), gives you economical backups entirely under your cryptographic control, without entrusting your keys to a third party.
The strengths of BorgBackup
- Variable-boundary chunk deduplication, formidably efficient on data that changes little.
- Authenticated encryption: confidentiality and integrity guarantee against any tampering with the repository.
- Compression of your choice (zstd, lz4, zlib) to trade off between size and speed.
- Named and timestamped archives, mountable via FUSE to browse a backup like a folder.
- Granular retention policy via
borg prune(daily, weekly, monthly, yearly). - Efficient transfer to a remote repository over SSH, sending only the new chunks.
Prerequisites for this deployment
Borg stays light on CPU, but its deduplication keeps an index in memory: plan for a VPS with 1 to 2 GB of RAM, with consumption growing with the number of chunks in the repository. Install the borgbackup package (and borgmatic to orchestrate more simply). On the destination side, you need either a Borg-compatible storage service or a second server accessible over SSH where Borg is also installed. An SSH key pair for non-interactive transfer and a location outside the VPS to keep the repository passphrase round out the prerequisites. Borgmatic, driven by a YAML file, considerably simplifies automation.
Configure Borg backups with borgmatic
Install Borg and borgmatic
On the VPS, install both packages (apt install borgbackup borgmatic). Check the version with borg --version. Borgmatic adds a declarative configuration layer on top of the raw Borg commands.
Initialize the remote encrypted repository
With an SSH key already deployed, initialize the repository: borg init --encryption=repokey-blake2 ssh://user@backup-host/./borg-repo. The repokey mode stores the encrypted key in the repository; you must keep the passphrase in a safe place outside the VPS.
Write the borgmatic configuration file
In /etc/borgmatic/config.yaml, declare the source_directories (for example /etc, /var/www, /opt), the remote repositories, the passphrase via an environment variable, and zstd compression. Borgmatic will chain create, prune and check in a single call.
Add database hooks
Borgmatic can dump your databases before the backup. Declare a postgresql_databases or mariadb_databases hook: the dump is generated, included in the archive, then cleaned up automatically, guaranteeing a consistent copy of the database.
Set retention and run a backup
Configure keep_daily: 7, keep_weekly: 4, keep_monthly: 6 in the retention section, then run borgmatic --verbosity 1. Borg transfers only the new chunks, making subsequent runs very fast.
Schedule and verify restores
Enable the systemd timer provided by borgmatic (systemctl enable --now borgmatic.timer) for daily execution. Test a restore with borgmatic extract --archive latest to a test folder, and let borgmatic check validate integrity regularly.
BorgBackup or Restic: which to choose?
| Criterion | BorgBackup | Restic |
|---|---|---|
| Storage model | Single-machine repository, SSH access | Multi-source to a single object repository |
| Native backends | Local and SSH (Borg server required) | S3, B2, Azure, SFTP, rest-server |
| Deduplication | Variable chunks, very dense | Variable chunks, efficient |
| Compression | Configurable (zstd, lz4, zlib) | Limited (historically no compression) |
| Encryption | Authenticated (tamper-proof) | Client-side AES-256 |
| Concurrent access | One client at a time on the repository | Multiple clients in parallel |
| Object storage (S3) | Indirect (via a third-party layer) | Native and direct |
| Orchestration tool | borgmatic (YAML) | Scripts or third-party wrappers |
Borg's Achilles' heel is that it allows only one client at a time on a repository and can leave a residual lock if a run is interrupted: monitor and automate clearing stuck locks with borg break-lock in your script, but only after verifying that no other process is writing. To guard against a VPS compromise, create on the backup server side a restricted SSH key with command="borg serve --append-only": the attacker will then only be able to add archives, never destroy the existing history.
