The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
A dependable Linux VPS backup with restic has six parts: store the repository away from the VPS, initialize it once, export databases before copying files, schedule a locked backup job, review retention before pruning, and repeatedly prove that restores work. Restic encrypts and authenticates repository data on the client, but losing the repository password makes the data irrecoverable and a storage compromise can still delete backups. The procedure below builds a recoverable backup rather than merely a collection of snapshots.
What a recoverable VPS backup must contain
Back up the parts required to rebuild the service, not every byte on the server. A practical path set usually includes:
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
- System and service configuration:
/etc, service-unit files, reverse-proxy configuration, firewall definitions, deployment manifests, and scheduled-job definitions. - Application code and deployment data: the directories under
/srvor another documented application root, including environment templates and deployment scripts. - User and uploaded data:
/homeand upload directories that are not reproducible from source control. - Persistent service data: selected paths such as
/var/lib/docker/volumeswhen containers keep important state there. - Database exports: native dumps written to a protected staging directory before restic scans the filesystem.
- Recovery secrets and certificates: TLS material and other credentials where your security policy permits their inclusion. Document how each secret is retrieved; a backup that cannot be decrypted or authenticated is not a recovery plan.
Do not automatically include package caches, application caches, temporary files, downloaded archives, or other reproducible data. Excluding them reduces repository growth and shortens backup and restore windows. Replace the example paths with the paths used by the services on your VPS, and keep that path list in the operations documentation.
Choose storage that is separate from the VPS
A repository is a directory that may be local or remote. The important design decision is failure separation: if the VPS host is compromised, destroyed, or accidentally reimaged, the repository and its credentials must remain available. Restic encrypts data before it leaves the client, so the storage system does not need access to plaintext files; it still needs protection against deletion and unauthorized repository access.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
| Destination | How it separates failures | Access and controls | Restore considerations |
|---|---|---|---|
| External USB backup drive | Physically separate from the VPS; useful as a local repository or second copy | Keep the drive disconnected or access-controlled when not in use; restic encryption still depends on the repository password | Fast when attached to the recovery system; it does not provide geographic separation unless a copy is stored elsewhere |
| SFTP repository | Places the repository on another host or storage service | Use an SSH key for unattended jobs and a separate account that cannot administer the VPS | Network bandwidth and remote-host availability determine restore time |
| S3-compatible object storage | Places objects outside the VPS host and can be geographically separated | Use dedicated access credentials; append-only or object-lock features can reduce deletion risk where the backend supports them | Restore speed depends on network throughput; storage and egress charges follow the selected backend |
For stronger resilience, keep an off-site SFTP or S3-compatible repository and a second copy such as an external USB drive. Use geographic separation when losing the VPS location itself is in scope. No destination removes the need to protect the restic password or to test a restore.
Prepare the repository and its credentials
Keep the repository password independent
The repository password is the key to every encrypted snapshot. The restic project warns: “Losing your password means that your data is irrecoverably lost.” Do not derive it from the VPS root password, store it only on the VPS, or leave it in shell history. Place it in an independent secret manager, a protected offline record, or both. Document who can retrieve it during a rebuild and how that person reaches the repository.
Recommended Free Tools
A password file used by an unattended service should be readable only by root (for example, mode 0600) and should be backed up or escrowed outside the machine it protects. If you use RESTIC_PASSWORD_FILE, the file must be present before the service starts. You can also supply the repository location through RESTIC_REPOSITORY_FILE when keeping the location in a root-readable file is preferable.
Initialize an S3-compatible repository
Create a bucket or endpoint that is not administered by the VPS credentials. Then set the repository and password file and initialize once:
export RESTIC_REPOSITORY='s3:https://s3.example.com/vps-backups'
export RESTIC_PASSWORD_FILE='/etc/restic/password'
restic initrestic init creates the repository structure and encryption metadata. Run it only against an empty location intended for this repository. Verify that the identity used by the backup job can read and write the repository but cannot change the VPS itself or delete unrelated storage.
Initialize an SFTP repository
For SFTP, a repository URL can look like:
sftp:user@host:/srv/restic-repoConfigure SSH-key authentication for the account used by the job. The key must not require an interactive password prompt, and its server-side account should be limited to the repository path where possible. Protect the private key and record an independent recovery copy. Set RESTIC_REPOSITORY (or its file-based equivalent) and RESTIC_PASSWORD_FILE in the service environment, then run restic init once.
Make application and database data consistent
Restic reads filesystem paths and creates point-in-time snapshots; it does not make an in-flight database transaction consistent by itself. Export each database with that database’s native dump or backup command before running restic backup. If an application writes files and database rows that must agree, put the application in maintenance mode, stop writers, or otherwise quiesce it for the duration of the export and file capture.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Create a private staging directory and ensure that the dump completes successfully before the backup job continues:
install -d -m 0700 /var/backups/db
# Run the database's native dump command here, writing into /var/backups/db.Use a separate dump file per database or service, include the command and retention expectations in your runbook, and alert if the dump command exits nonzero or produces an unexpectedly empty file. Keep the dump directory in the restic path list so a filesystem restore contains the database export as well as application files. Test importing that dump periodically; the existence of a dump file is not proof that the database can use it.
Run the first backup and confirm a snapshot
After the repository is initialized and the database export has succeeded, run a deliberately explicit first backup:
restic backup /etc /home /srv /var/lib/docker/volumes /var/backups/db
--exclude-caches --tag vpsThe command scans the listed paths, deduplicates content, encrypts it, and records a snapshot tagged vps. Add or remove paths to match the services actually hosted on the machine. Include configuration, deployment files, uploads, permitted TLS material, persistent container volumes, and completed database dumps. Exclude caches and package downloads rather than discovering during a restore that an essential upload directory was omitted.
Immediately inspect the result:
restic snapshotsConfirm that the expected host, timestamp, path list, and tag appear. Keep the first snapshot identifier in the change record for the VPS. A successful command with no visible snapshot usually means the job used a different repository environment than the one you inspected.
Automate backups without overlapping jobs
Use a root-owned service and timer
A systemd service plus timer gives you a single place to define credentials, logging, and scheduling. Put repository settings in a root-readable environment file such as /etc/restic/restic.env and set restrictive permissions. It can contain:
RESTIC_REPOSITORY=sftp:user@host:/srv/restic-repo
RESTIC_PASSWORD_FILE=/etc/restic/passwordKeep the backup command in a root-owned script, for example /usr/local/sbin/restic-vps-backup:
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
#!/bin/sh
set -eu
umask 077
# Acquire a non-blocking lock here so a slow run cannot overlap the next one.
install -d -m 0700 /var/backups/db
# Run the database's native dump command and stop on failure.
restic backup /etc /home /srv /var/lib/docker/volumes /var/backups/db
--exclude-caches --tag vpsMake the script executable and ensure it exits nonzero when a dump or restic operation fails. A systemd unit can run it as a oneshot service with an EnvironmentFile:
[Unit]
Description=Back up VPS data with restic
[Service]
Type=oneshot
EnvironmentFile=/etc/restic/restic.env
ExecStart=/usr/local/sbin/restic-vps-backupPair it with a timer that starts after networking is available. Choose an interval that fits the amount of changed data and the recovery point your service requires. Schedule database exports inside the service so the dump and filesystem capture belong to one controlled run. Configure your monitoring to alert on a failed unit, a missed timer, or an unexpectedly old snapshot.
Use cron only with equivalent safeguards
If systemd is not available, a locked cron job can run the same script. The lock is essential: a long upload must not overlap the next invocation and produce competing database dumps or excessive repository work. Redirect output to a monitored log, preserve the exit status, and load RESTIC_REPOSITORY and RESTIC_PASSWORD_FILE from a protected file rather than placing the password directly in the crontab.
Separate backup and maintenance windows
Run restic snapshots after initial deployment and at regular intervals to confirm that new snapshots arrive. Schedule repository maintenance separately when it competes with the backup window. Pruning can consume substantial I/O and network resources, so do not let it silently delay the backup job that supplies your newest recovery point.
Check repository integrity, then apply retention
Use check for repository consistency
Run:
restic checkrestic check examines repository structure and integrity. It does not boot your application, validate a database dump, or prove that an end-to-end restore works. Treat a clean check as evidence that repository data is internally consistent, not as a substitute for a restore drill.
Review forget before pruning
A retention policy changes which snapshots remain available. A representative policy is:
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12Review the command’s dry-run or proposed output and compare the snapshots that would remain with your recovery requirements before accepting it. Include tagged snapshots or host-specific rules when one repository serves more than one machine. Do not run a policy copied from another VPS without checking its backup frequency and regulatory retention needs.
Free tools Windows power users keep installed
One-click scans. No signup required.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Only after confirming the retained snapshot set should you run:
restic pruneforget changes the retention selection; prune removes unneeded repository data. If a mistake removes a required snapshot, pruning cannot recreate it. Keep pruning in a separate, monitored maintenance job and record the policy revision.
Prove recovery with real restore drills
The restic project README puts the priority plainly: “Much more important than backup is restore.” Make restore testing a recurring requirement, not an activity reserved for an outage.
Test a single important file
First verify that a known file can be recovered without touching the live path:
restic snapshots
restic restore latest --target /var/tmp/restic-restore-test
sha256sum /var/tmp/restic-restore-test/path/to/important-fileCompare the restored file’s hash with the known-good source or an independently recorded value. Check ownership, permissions, symbolic links, and extended attributes when the application depends on them. Delete the temporary directory after the test only if your evidence and retention policy allow it.
Perform a clean-directory restore
Restore a representative configuration and upload set into an empty target, not over the production tree. Confirm that the expected directories, files, links, and permissions are present. This catches omissions in the path list and mistakes in exclusion rules that a single-file test can miss.
Run a disposable VPS rebuild drill
- Provision a disposable instance with the operating system and network access required by the application.
- Install restic and retrieve the repository location, password, and any SFTP key or object-storage credentials from their independent recovery records.
- Run
restic snapshotsand select a documented snapshot rather than assuminglatestis appropriate. - Restore configuration and application data into the expected paths, then reinstall or start the required services.
- Import the restored database dump with the database’s native restore or import command.
- Start the application and verify login, background jobs, uploads, TLS, and any external integrations that matter to users.
- Record the date, snapshot ID, paths restored, failures encountered, and observed recovery time. Turn every manual workaround into a runbook step.
Repeat the drill after major application, database, storage, or credential changes. A repository that passes check but cannot produce a working service has not met the recovery objective.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Harden the design against deletion and credential compromise
- Separate identities: repository credentials should not administer the VPS, and VPS credentials should not have unrestricted authority over every backup copy.
- Limit deletion: use append-only permissions or object-lock capability where the storage backend supports them. Test the policy with a nonproduction repository before relying on it.
- Keep a second location: geographic separation and an independent external copy reduce the chance that one incident removes every snapshot.
- Protect secrets: restrict password files and SSH keys, avoid command-line passwords, and maintain an offline recovery record.
- Monitor age and failures: alert when the newest snapshot is older than the allowed recovery-point interval, when a timer fails, or when maintenance reports an error.
- Document ownership: record who can authorize a restore, where the repository lives, which paths are included, and how credentials are recovered.
Restic’s encryption and authentication protect repository confidentiality and integrity, but they do not stop an attacker who has deletion access from removing repository data. Storage controls and credential isolation are therefore part of the backup system, not optional extras.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Repair Windows errors before they cause bigger problems3Fix the driver behind crashes, sound loss and screen glitchesTroubleshoot common failures
No snapshots appear after a successful-looking run
Print the environment used by the service (without exposing the password), confirm RESTIC_REPOSITORY or RESTIC_REPOSITORY_FILE, and run restic snapshots under the same account and unit. A shell test often points at a different repository than the timer.
The job asks for a password or SSH passphrase
Verify that RESTIC_PASSWORD_FILE is present and root-readable, and that the SFTP key is available without an interactive prompt. A scheduled job must fail clearly rather than waiting indefinitely for terminal input.
The repository check fails
Stop pruning and investigate the storage connection, permissions, and repository location. Preserve logs and, if available, use another repository copy for comparison. Do not treat a failed check as a reason to delete the repository that may still contain your only usable snapshots.
The restore lacks application data
Compare the restored path list with the backup command and its exclusions. Add missing upload, volume, configuration, or dump paths, then run a new backup and restore test. A successful restic command cannot recover a path it never received.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Backups overlap or exhaust resources
Add a non-blocking lock, lengthen the timer interval, reduce unnecessary paths, and schedule prune separately. Observe repository growth and network usage before changing retention; deleting snapshots is not a substitute for fixing an oversized or noisy path selection.
Quick Recap
Operational checklist
- Repository initialized on storage separate from the VPS.
- Repository password stored and documented outside the VPS.
- SFTP or object-storage credentials limited to backup duties.
- Database dumps complete before filesystem capture.
- Configuration, uploads, persistent volumes, permitted TLS material, and dumps included.
- Caches, package downloads, and reproducible temporary data excluded.
- Scheduled job loads protected environment files and cannot overlap.
restic snapshotsconfirms fresh snapshots.restic checkruns on a regular schedule.forgetpolicy reviewed beforeprune.- Single-file, clean-directory, and disposable-instance restores tested and recorded.
- Failure alerts and an independent recovery record are in place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
