Back up a VPS properly

A backup is only useful if it lets you restore the service after deletion, failure or compromise. Copying a whole disk while services are writing is not enough, and an archive left on the same VPS does not protect against losing the machine. This procedure defines the content, produces verified copies and stores them off site.

What to back up

Back up what cannot be recreated: /etc for configuration, /var/www and /srv for code and data, /home for accounts, database dumps, crontabs, systemd units and Docker volumes. Also record installed packages:

dpkg --get-selections | sudo tee /var/backups/packages.txt >/dev/null

Exclude /proc, /sys, /dev, /run, /tmp, /var/cache and logs. For a database, a logical dump is better than copying files while it runs: the dump is consistent, the copy is not.

Archive and sync

sudo tar --one-file-system --acls --xattrs -czf /var/backups/etc-$(date +%F).tar.gz /etc
tar -tzf /var/backups/etc-$(date +%F).tar.gz | head

--one-file-system avoids pulling in a separate mount; --acls and --xattrs preserve metadata. Check the listing and integrity with gzip -t before moving it. For incremental file copies:

rsync -aHAX --numeric-ids --delete /var/www/ backup@server:/backups/vps/www/

--delete removes remote files that disappeared locally: run with --dry-run first. -aHAX preserves links, ACLs and extended attributes. For databases, add a dump (mariadb-dump or pg_dump) before syncing, never a copy of the active data file.

3-2-1 rule and encryption

Three copies, two media, one off site. A copy on the same VPS does not protect against disk failure or accidental deletion. Encrypt before transfer with age or gpg, and keep the key outside the backed-up server: an unreadable backup is worthless during a disaster.

Automate and test

A /usr/local/sbin/backup-vps.sh script with set -eu, flock, database dumps, archive, rsync and age-based cleanup. Schedule it with cron or a systemd timer and check the journal. Test monthly: download an archive, unpack it in /tmp, restore one file and import a dump into a throwaway database. Check du -sh and free space before sending.

Backups included with the VPS plan are a safety net, not a complete plan: they do not replace a tested off-site copy. Before a reinstall or migration, make a manual backup and verify it.