[{"data":1,"prerenderedAt":137},["ShallowReactive",2],{"seo-verification":3,"blog-self-host-backrest-on-a-vps-encrypted-backups-no-command-line-en":6},{"google":4,"bing":5},"EycwPY2XMyTkVzas3n1ygeNJFGAH513qrMjfDljzsMQ","",{"id":7,"slug":8,"slugs":9,"title":12,"excerpt":13,"readTime":14,"views":15,"isPinned":16,"publishedAt":17,"category":18,"categories":24,"featuredImage":26,"bgImage":27,"posterImage":28,"relatedSolution":29,"intro":32,"sections":33,"ctaTitle":79,"ctaBody":80,"ctaButton":81,"ctaUrl":82,"relatedPosts":83},195,"self-host-backrest-on-a-vps-encrypted-backups-no-command-line",{"fr":10,"en":8,"ar":11},"self-host-backrest-vps","استضافة-backrest-على-vps-نسخ-احتياطي-مشفر-بلا-سطر-أوامر","Self-host Backrest on a VPS: encrypted backups, no command line","Deploy Backrest on your VPS to schedule encrypted, deduplicated restic backups to Backblaze B2 or S3, and restore a single file in a few clicks from the browser.",5,0,false,"2026-07-28T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},8,"Security & Monitoring","securite-monitoring","bg-rose-500\u002F10 text-rose-400","security",[25],{"id":19,"name":20,"slug":21,"color":22,"icon":23},null,"\u002Fblog\u002Fcovers\u002Fbg.svg","\u002Fblog\u002Fcovers\u002Fself-host-backrest-vps-poster.svg",{"categorySlug":30,"appSlug":31},"application-deployment-devops","backrest","Everyone knows they should back up their server. Almost nobody actually does — because restic, the best open-source tool for the job, is a command-line utility you have to wrap in your own scripts and cron entries. Backrest removes that friction: same engine, same security, driven from a browser. And, crucially, a backup that tells you when it fails.",[34,38,49,52,75],{"type":35,"title":36,"body":37},"h2","The problem: the backup everyone postpones","Backing up a VPS is the task everyone puts off, because it returns nothing until the day it returns everything. Provider snapshots are convenient, but they copy the whole machine to the same provider in the same place: they protect against your own mistakes, not against losing the account or an incident on the infrastructure. And a snapshot will not give you back one file that was overwritten this morning.\n\nThe reference open-source answer is restic: end-to-end encryption, deduplication, incremental snapshots, and support for virtually every object store. Its only weakness is ergonomic — it is a command-line tool. Adopting it in practice means writing your own scripts, cron entries, retention policy, periodic pruning and monitoring. Many people stop after the first script, and nobody notices when it quietly stops running.",{"type":39,"title":40,"items":41},"ul","What Backrest adds on top of restic",[42,43,44,45,46,47,48],"A web interface to create repositories, run backups and browse snapshots as a file tree.","Cron-style scheduling per plan, with retention policies (keep N daily, weekly, monthly) defined in the browser.","Automatic repository maintenance: scheduled `prune` to reclaim space and `check` to catch corruption before you need the backup.","Granular restore — a single file or folder — with no full restore and no downtime.","Hooks on start, success and failure: notify ntfy, Discord, Slack or any webhook, or run a shell command.","Multiple repositories and multiple plans side by side from a single instance.","A single Go binary, under 100 MB RAM, no database — restic ships inside the image.",{"type":35,"title":50,"body":51},"Architecture: one container, and your data stays yours","Backrest is a single Go binary that bundles restic. It runs in one container with no database and no external cache: its configuration lives in a JSON file and its state in a data directory. That is the opposite of enterprise backup stacks, and it is what makes it a sensible fit for a modest VPS.\n\nThe direction of the encryption is what matters. restic encrypts every snapshot locally, on your server, before a single byte leaves it: the destination only ever receives opaque blocks. The repository password is the key, and you alone hold it — which means the storage can be a cheap, untrusted provider without any confidentiality problem, but also that losing that password makes the backups permanently unreadable. That is the explicit trade-off of any client-side encryption.\n\nIn the ServOrbit recipe, the host's `\u002Fhome`, `\u002Froot` and `\u002Fetc` are mounted **read-only** under `\u002Fhost` inside the container. Backrest can therefore back up the server's data and configuration while being structurally unable to modify them.",{"type":53,"title":54,"items":55,"steps":71},"steps","Deploy Backrest and protect a VPS in 5 steps",[56,59,62,65,68],{"title":57,"body":58},"Deploy Backrest from the ServOrbit marketplace","Open your ServOrbit dashboard → Marketplace → Backrest → Install. The image is pulled, the directories to protect are mounted read-only and the service starts on port 9898. No domain name is required — the interface answers on the VPS IP. Install it on the server you want to protect, since it backs up that machine's filesystem.",{"title":60,"body":61},"Create your admin account","Open `http:\u002F\u002Fyour-vps-ip:9898`. On first run Backrest asks you to create a username and password — there are no default credentials. Do this immediately after install, before opening the port beyond your own address.",{"title":63,"body":64},"Add a backup repository","Choose Add Repo, select a backend and paste its credentials — for Backblaze B2, a bucket name and an application key. Pick a strong repository password and store it in your password manager: it is the encryption key, and it is not recoverable anywhere else.",{"title":66,"body":67},"Create a plan and schedule it","Add Plan, select the paths to protect (`\u002Fhost\u002Fhome`, `\u002Fhost\u002Fetc`), set a cron schedule and a retention policy — say 7 daily, 4 weekly, 6 monthly. Run it once by hand to confirm it completes before letting the schedule take over.",{"title":69,"body":70},"Wire the failure alert, then test a restore","Add a failure hook pointing at a webhook — a self-hosted ntfy topic does the job nicely. Then do the exercise almost nobody does: restore a file from a snapshot. A backup whose restore has never been tested is not a backup, it is an assumption.",[72],{"title":73,"body":74},"Logging in for the first time","When you first open the URL, Backrest displays its initial setup screen: you choose an instance ID (permanent), then create your own username and password yourself. Open this address immediately.",{"type":76,"title":77,"body":78},"tip","Tip: the 3-2-1 rule starts by leaving the server","The most common mistake is sending backups to a disk on the same server, or a volume at the same provider. That protects against accidental deletion, not against losing the machine or the account. Aim for at least one destination outside the VPS host: Backblaze B2 or Wasabi cost a few euros a month for tens of gigabytes, and thanks to restic's deduplication, months of daily retention stay far smaller than you would expect.","A server you can afford to lose","Deploy Backrest on a ServOrbit VPS and schedule end-to-end encrypted backups to the object storage of your choice — with file-level restore straight from the browser.","Deploy Backrest","\u002Fmarketplace\u002Fapplication-deployment-devops\u002Fbackrest",[84,100,116],{"id":85,"slug":86,"slugs":87,"title":90,"excerpt":91,"readTime":92,"views":15,"isPinned":16,"publishedAt":17,"category":93,"categories":94,"featuredImage":26,"bgImage":27,"posterImage":96,"relatedSolution":97},194,"self-host-ntfy-on-a-vps-push-notifications-for-scripts-and-cicd",{"fr":88,"en":86,"ar":89},"self-host-ntfy-vps","استضافة-ntfy-على-vps-إشعارات-فورية-من-سكريبتاتك-وcicd","Self-host ntfy on a VPS: push notifications for scripts and CI\u002FCD","Deploy ntfy on your VPS and send push notifications from any script, cron job or CI\u002FCD pipeline with a plain curl — no SaaS, no API key, no subscription.",4,{"id":19,"name":20,"slug":21,"color":22,"icon":23},[95],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fself-host-ntfy-vps-poster.svg",{"categorySlug":98,"appSlug":99},"monitoring-observability","ntfy",{"id":101,"slug":102,"slugs":103,"title":106,"excerpt":107,"readTime":108,"views":15,"isPinned":16,"publishedAt":109,"category":110,"categories":111,"featuredImage":26,"bgImage":27,"posterImage":113,"relatedSolution":114},133,"self-host-beszel-multi-server-monitoring-hub-on-your-vps",{"fr":104,"en":102,"ar":105},"self-host-beszel-vps","استضف-beszel-على-vps-مركز-مراقبة-متعدد-الخوادم","Beszel on VPS: multi-server monitoring, alerts and security","Deploy Beszel on a VPS, monitor your entire fleet from one hub, set up Telegram\u002Femail alerts, enable 2FA and fix silent agents, TLS errors and blocked ports.",10,"2026-02-14T00:00:00+00:00",{"id":19,"name":20,"slug":21,"color":22,"icon":23},[112],{"id":19,"name":20,"slug":21,"color":22,"icon":23},"\u002Fblog\u002Fcovers\u002Fself-host-beszel-vps-poster.svg",{"categorySlug":98,"appSlug":115},"beszel",{"id":117,"slug":118,"slugs":119,"title":122,"excerpt":123,"readTime":92,"views":124,"isPinned":16,"publishedAt":125,"category":126,"categories":132,"featuredImage":26,"bgImage":27,"posterImage":134,"relatedSolution":135},167,"how-to-self-host-dozzle-on-a-vps-real-time-docker-log-viewer",{"fr":120,"en":118,"ar":121},"self-host-dozzle-vps","استضافة-dozzle-على-vps-عارض-سجلات-docker-لحظيا","How to Self-Host Dozzle on a VPS: Real-Time Docker Log Viewer","Deploy Dozzle on your VPS — a stateless, open-source Docker log viewer. Stream, search and tail logs from all your containers in the browser, without SSH or log storage.",1,"2026-07-06T00:00:00+00:00",{"id":127,"name":128,"slug":129,"color":130,"icon":131},7,"Self-hosting","self-hosting","bg-indigo-500\u002F10 text-indigo-400","cloud",[133],{"id":127,"name":128,"slug":129,"color":130,"icon":131},"\u002Fblog\u002Fcovers\u002Fself-host-dozzle-vps-poster.svg",{"categorySlug":98,"appSlug":136},"dozzle",1787661732719]