The problem: the backup everyone postpones
Backing up a VPS is the task everyone puts off, because it returns nothing until the day it returns everything. Provider snapshots are convenient, but they copy the whole machine to the same provider in the same place: they protect against your own mistakes, not against losing the account or an incident on the infrastructure. And a snapshot will not give you back one file that was overwritten this morning.
The reference open-source answer is restic: end-to-end encryption, deduplication, incremental snapshots, and support for virtually every object store. Its only weakness is ergonomic — it is a command-line tool. Adopting it in practice means writing your own scripts, cron entries, retention policy, periodic pruning and monitoring. Many people stop after the first script, and nobody notices when it quietly stops running.
What Backrest adds on top of restic
- A web interface to create repositories, run backups and browse snapshots as a file tree.
- Cron-style scheduling per plan, with retention policies (keep N daily, weekly, monthly) defined in the browser.
- Automatic repository maintenance: scheduled
pruneto reclaim space andcheckto catch corruption before you need the backup. - Granular restore — a single file or folder — with no full restore and no downtime.
- Hooks on start, success and failure: notify ntfy, Discord, Slack or any webhook, or run a shell command.
- Multiple repositories and multiple plans side by side from a single instance.
- A single Go binary, under 100 MB RAM, no database — restic ships inside the image.
Architecture: one container, and your data stays yours
Backrest is a single Go binary that bundles restic. It runs in one container with no database and no external cache: its configuration lives in a JSON file and its state in a data directory. That is the opposite of enterprise backup stacks, and it is what makes it a sensible fit for a modest VPS.
The direction of the encryption is what matters. restic encrypts every snapshot locally, on your server, before a single byte leaves it: the destination only ever receives opaque blocks. The repository password is the key, and you alone hold it — which means the storage can be a cheap, untrusted provider without any confidentiality problem, but also that losing that password makes the backups permanently unreadable. That is the explicit trade-off of any client-side encryption.
In the ServOrbit recipe, the host's /home, /root and /etc are mounted read-only under /host inside the container. Backrest can therefore back up the server's data and configuration while being structurally unable to modify them.
Deploy Backrest and protect a VPS in 5 steps
Logging in for the first time
When you first open the URL, Backrest displays its initial setup screen: you choose an instance ID (permanent), then create your own username and password yourself. Open this address immediately.
Tip: the 3-2-1 rule starts by leaving the server
The most common mistake is sending backups to a disk on the same server, or a volume at the same provider. That protects against accidental deletion, not against losing the machine or the account. Aim for at least one destination outside the VPS host: Backblaze B2 or Wasabi cost a few euros a month for tens of gigabytes, and thanks to restic's deduplication, months of daily retention stay far smaller than you would expect.
