How to Backup and Restore a Linux VPS: Automated Restic & Rclone Strategy

The 3-2-1 Backup Rule for Cloud Infrastructure

Hardware failures, accidental deletions (like a misdirected rm -rf), and zero-day ransomware attacks can wipe out an entire cloud VPS in milliseconds. Every production server must follow the golden 3-2-1 backup principle: keep 3 copies of your data on 2 different media types, with at least 1 copy hosted completely offsite.

Why Restic is the Gold Standard for Linux Backups

Unlike archaic tools like tar or basic rsync, Restic features content-defined chunking and deduplication. If you have 50GB of files and only 5MB changes today, Restic only uploads 5MB. Furthermore, every backup snapshot is cryptographically encrypted using AES-256 before leaving your VPS.

Step 1: Installing Restic and Rclone

sudo apt update
sudo apt install -y restic rclone

Step 2: Initializing the Encrypted Backup Repository

You can store backups on a secondary Contabo Storage VPS, an AWS S3 bucket, Backblaze B2, or Cloudflare R2. In this example, we configure a secure remote repository:

export RESTIC_REPOSITORY="s3:s3.eu-central-1.wasabisys.com/my-production-backups"
export RESTIC_PASSWORD="A_VERY_LONG_CRYPTOGRAPHIC_PASSWORD_PHRASE"
export AWS_ACCESS_KEY_ID="YOUR_S3_KEY"
export AWS_SECRET_ACCESS_KEY="YOUR_S3_SECRET"

# Initialize repository
restic init

Step 3: Creating a Backup Script with Exclusions

Certain dynamic directories (like /dev, /proc, /sys, and temporary cache folders) should never be backed up. Create an exclusion file:

sudo nano /etc/restic-excludes.txt

/dev
/proc
/sys
/tmp
/run
/mnt
/media
/lost+found
/var/tmp
/var/cache
/swapfile

Now create the master backup script:

sudo nano /usr/local/bin/system-backup.sh

#!/bin/bash
set -e

export RESTIC_REPOSITORY="s3:s3.eu-central-1.wasabisys.com/my-production-backups"
export RESTIC_PASSWORD="A_VERY_LONG_CRYPTOGRAPHIC_PASSWORD_PHRASE"
export AWS_ACCESS_KEY_ID="YOUR_S3_KEY"
export AWS_SECRET_ACCESS_KEY="YOUR_S3_SECRET"

echo "=== Starting Restic Backup at $(date) ==="
restic backup / \
  --exclude-file=/etc/restic-excludes.txt \
  --tag "daily-production"

echo "=== Pruning Old Snapshots (Retention Policy) ==="
restic forget \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 6 \
  --prune

echo "=== Backup Completed Successfully ==="

sudo chmod 700 /usr/local/bin/system-backup.sh

Step 4: Automating with Systemd Timer or Cron

Schedule the backup to execute every night at 2:00 AM UTC:

(crontab -l 2>/dev/null; echo "0 2 * * * /usr/local/bin/system-backup.sh >> /var/log/restic-backup.log 2>&1") | crontab -

Step 5: Testing Restoration (Disaster Simulation)

A backup that has never been tested is not a real backup. Inspect your remote snapshots and restore an isolated directory:

# List available snapshots
restic snapshots

# Restore latest snapshot to a test folder
restic restore latest --target /tmp/restore-test --include /etc/nginx

# Verify restored config
ls -la /tmp/restore-test/etc/nginx

Frequently Asked Questions (FAQ)

How much bandwidth does Restic consume on daily runs?

Because Restic uses cryptographic block deduplication, a daily incremental backup on a 50GB server typically transfers less than 20MB of changed data, completing in under 30 seconds.