docs/content/vps/automated-backups.md

title, description, section, order

title	description	section	order
Set Up Automated Backups with Restic	Automate encrypted off-site backups on your Arcline VPS using restic.	vps	6

Set Up Automated Backups with Restic

Restic is a fast, encrypted backup tool that supports local and remote storage backends (SFTP, S3, B2, rsync.net). This guide covers backing up your VPS to a remote repository.

---

Prerequisites

• A VPS with sudo access
• A backup destination (SFTP server, Backblaze B2, or local storage)

---

Step 1 — Install restic

sudo apt update
sudo apt install restic -y

Verify:

restic version

---

Step 2 — Initialize a repository

Option A: SFTP/SSH (recommended for Arcline customers)

If you have SSH access to a backup server:

restic init --repo sftp:backup@backup-server:/var/backups/example-vps/

You'll be prompted for a repository password — this encrypts your backups. Store it in a password manager — if you lose it, you cannot recover your data.

Option B: Backblaze B2

export B2_ACCOUNT_ID="your-application-key-id"
export B2_ACCOUNT_KEY="your-application-key"
restic init --repo b2:bucket-name:/example-vps

Option C: Local directory

sudo mkdir -p /backups/example-vps-repo
restic init --repo /backups/example-vps-repo

---

Step 3 — Create a backup script

sudo nano /usr/local/bin/backup.sh

#!/bin/bash
set -e

# Repository location and password
export RESTIC_REPOSITORY="sftp:backup@backup-server:/var/backups/example-vps/"
export RESTIC_PASSWORD="your-repo-password"

# Files and directories to back up
BACKUP_PATHS=(
    /var/www
    /etc/nginx
    /etc/letsencrypt
    /opt
    /home
)

# Directories to exclude
EXCLUDE_PATTERNS=(
    --exclude "/var/www/example.com/cache"
    --exclude "*.log"
)

echo "Starting backup at $(date)"

# Create the backup
restic backup "${EXCLUDE_PATTERNS[@]}" "${BACKUP_PATHS[@]}"

# Keep last 7 daily, 4 weekly, 6 monthly snapshots
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

echo "Backup completed at $(date)"

Make it executable:

sudo chmod +x /usr/local/bin/backup.sh

---

Step 4 — Test the backup

Run the backup manually:

sudo /usr/local/bin/backup.sh

List snapshots:

restic -r sftp:backup@backup-server:/var/backups/example-vps/ snapshots

You'll need RESTIC_PASSWORD exported or passed via --password-file for any restic command.

---

Step 5 — Schedule daily backups with systemd

Create a service file:

sudo nano /etc/systemd/system/restic-backup.service

[Unit]
Description=Restic backup
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup.sh

Create a timer:

sudo nano /etc/systemd/system/restic-backup.timer

[Unit]
Description=Daily restic backup

[Timer]
OnCalendar=daily
RandomizedDelaySec=3600
Persistent=true

[Install]
WantedBy=timers.target

Enable and start the timer:

sudo systemctl daemon-reload
sudo systemctl enable restic-backup.timer
sudo systemctl start restic-backup.timer

Verify:

sudo systemctl status restic-backup.timer
sudo systemctl list-timers | grep restic

---

Step 6 — Restoring from a backup

List available snapshots:

restic -r sftp:backup@backup-server:/var/backups/example-vps/ snapshots

Restore the latest snapshot:

restic -r sftp:backup@backup-server:/var/backups/example-vps/ restore latest --target /tmp/restore

Or restore a specific snapshot by ID:

restic -r ... restore <snapshot-id> --target /tmp/restore

To restore only specific paths:

restic -r ... restore <snapshot-id> --target /tmp/restore --path /var/www

---

Step 7 — Database backups

For MySQL databases, add a pre-backup dump step:

#!/bin/bash
set -e

# Dump all databases
mysqldump --all-databases --single-transaction --quick | gzip > /tmp/mysql-all.sql.gz

# Include the dump in the backup
restic backup --hostname example-vps /tmp/mysql-all.sql.gz "${BACKUP_PATHS[@]}"

rm /tmp/mysql-all.sql.gz

---

Monitoring backups

Add a health check notification:

# After successful backup
curl -fsS -m 10 --retry 5 https://hc-ping.com/your-uuid

# Or on failure, notify via Discord/Slack webhook
curl -fsS -m 10 -X POST -H "Content-Type: application/json" \
  -d '{"content":"Backup failed on example-vps"}' \
  https://discord.com/api/webhooks/your-webhook-url

---

What's next

• Install fail2ban for SSH brute-force protection
• Set up a Go service with systemd