Use Duplicity to create GPG-encrypted backup volumes, send them to storage such as SFTP or Amazon S3, and run the same command on a schedule. The first run is a full backup; later runs are incremental and contain only changed data. A reliable design also protects the GPG key and destination credentials, records failures, excludes pseudo-filesystems such as /proc when necessary, and proves that a restore works before old backup chains are removed.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What Duplicity and GPG do together
Duplicity packages files into tar-format volumes, uses GnuPG to encrypt and optionally sign those volumes, then writes them to a local directory or a remote backend. Its librsync-based incremental process means subsequent runs do not resend unchanged data. Encryption occurs before the files leave the Ubuntu host, so a storage operator can hold the backup objects without being able to read their contents. Signing can also reveal whether an archive was modified.
As an Amazon Associate I earn from qualifying purchases.
Ubuntu Noble currently packages duplicity as version 2.1.4-3ubuntu2. Exact options can vary with distribution packaging, so check the installed manpage with man duplicity and confirm the binary version with duplicity --version.
The backup chain
- Full volume: a complete snapshot of the selected source. It starts a new chain.
- Incremental volumes: changes recorded after the most recent full or incremental run.
- GPG material: the private key and passphrase needed to decrypt a restore. A public key alone cannot recover encrypted data.
- Backend objects: the encrypted volumes, signatures, and Duplicity metadata stored locally, over SSH/SFTP, or in object storage.
Deleting one volume can break every restore that depends on it. Treat each full backup and its incrementals as a chain, not as independent files.
#1 Best Overall
- BLUE LIGHT BLOCKING GLASSES: Our blue light glasses for women boast UV400 protection, blocking harmful blue rays from computer screens. With these bluelight glasses women, you can enjoy gaming, reading, or watching TV with no worries of eye strain.
- EYE RELIEF: Our blue light glasses are engineered to reduce blurry vision or strain caused by prolonged screen time. These womens blue light glasses aid in better sleep by preventing blue light from disrupting your natural sleep cycle, helping you fall asleep faster and enjoy a more restful night's sleep, making them the perfect christmas present.
- COMFORTABLE: Crafted from durable material, our trendy blue light glasses for woman or blue light glasses men ensure long-lasting comfort. The high-transmittance lenses accessories, gamer gifts for men, help keep your eyes relaxed. Perfect stocking stuffers, gifts for gamers men, christmas gifts for men, halloween costumes.
- LIGHTWEIGHT: These clear blue light glasses feature a lightweight frame, meaning they’ll stay comfy for long-term wear. Perfect as blue blockers glasses for women or mens blue light glasses, these non-prescription fake glasses for men can be worn throughout the day. The blue light blocking glasses women feature polycarbonate HD lenses, which are anti-reflective and restore true color.
- WORRY-FREE PURCHASE: If you experience any issues, our support team is ready to assist you quickly. These are the perfect costume glasses for cosplay dressing up.
Plan the recovery target before scheduling anything
Automation is useful only if it meets a recovery requirement. Decide how much data loss is acceptable, how far back a restore must reach, where a replacement Ubuntu host will run, and who can retrieve the GPG key. Those decisions determine schedule, retention, destination, and credential storage.
Questions to answer
- What is the recovery point objective: hourly, daily, or another interval?
- How quickly must a complete restore finish, and is the bottleneck the network, storage backend, or local disk?
- Must the backup survive loss of the Ubuntu host, its disk, its datacenter, or an entire geographic region?
- Which account is allowed to read, write, list, and delete backup objects?
- Where are the private GPG key, passphrase, and any signing key stored during a disaster?
A remote destination protects against loss of the original host. GPG encryption protects confidentiality from the destination operator, but it does not help if the only copy of the private key or passphrase disappears with that host.
Install Duplicity and GnuPG on Ubuntu
- Refresh package metadata:
sudo apt update - Install the backup and OpenPGP tools:
sudo apt install duplicity gnupg - Verify the installed versions and available backends:
duplicity --version gpg --version man duplicity
Install the SSH client when using an SFTP or SCP destination. For an object-storage backend, install and configure the backend support required by the Ubuntu package and your chosen service; do not assume that a generic command-line client alone supplies Duplicity’s backend integration.
Create or import a GPG key for unattended encryption
Public-key encryption is the normal unattended pattern. Duplicity encrypts with the recipient’s public key, while a restore uses the matching private key. Generate the key as the account that will perform restores, or import an existing operational key into the service account’s protected GnuPG home.
Generate a key interactively
- Run
gpg --full-generate-keyand choose a modern public-key algorithm offered by the installed GnuPG version. - Use an identity that clearly identifies the backup recipient, such as a host or recovery role, rather than a personal nickname.
- Set a strong passphrase and record the creation date and key fingerprint.
- List the key and copy its fingerprint or short key ID:
gpg --list-keys --fingerprint
Use the full fingerprint where practical to avoid selecting an unintended key with a matching short ID. Export a protected recovery copy of the private key, for example to offline media held separately from the Ubuntu server. Never leave that export in the source directory being backed up.
Rank #2
- WINDEX GAMING WIPES: effortlessly clean all your gaming gear and gaming electronics in one easy step with our new Windex Gaming Wipes
- AMMONIA FREE: our ammonia-free formula is safe to use on all of your favorite gaming equipment like consoles, headsets, controllers, screens, keyboards, and more
- PRE-MOISTENED WIPES: each wipe instantly removes dust, dirt, and stubborn smudges and fingerprints leaving a streak-free shine
- ANTI-STATIC: great for cleaning and wiping down your gaming gear and electronics leaving behind no visible residue
- COMPACT RESEALABLE PACKAGE: store your pack of Windex Gaming Wipes anywhere in your home for whenever a quick and easy wipedown is needed
Separate encryption and signing identities
The --encrypt-key option selects the recipient used for encryption. Add --sign-key when you want Duplicity to create signatures with a signing key. Keep signing keys and encryption keys in the same recovery plan: a restore may require whichever material was used when the volumes were created.
Use gpg-agent without exposing a passphrase
Duplicity documents --use-agent for connecting to gpg-agent. This can keep the passphrase out of command lines, shell history, and long-lived environment variables. Configure the agent for the service account, test an unattended invocation, and ensure the agent’s socket and key files are readable only by that account.
Choose a destination: SFTP, SSH, or object storage
Duplicity supports local file URLs, SFTP/SCP and rsync-over-SSH, and Amazon S3 among other backends. Select a backend by recovery characteristics rather than by convenience alone.
| Destination | Recovery speed | Separation and access control | Cost considerations | Operational concerns |
|---|---|---|---|---|
| SFTP or SCP host | Often predictable for large sequential restores when the host has sufficient bandwidth and disk. | Separate server credentials and SSH keys; geographic separation depends on where that server is operated. | Usually a recurring storage and transfer charge set by the host; request pricing is generally simpler than object storage. | Maintain host availability, disk capacity, SSH hardening, and a way to rebuild the backup account. |
| Amazon S3 backend | Can scale well, but restore time depends on object retrieval, network throughput, and request limits. | Use a narrowly scoped access identity and bucket policy; object storage can be placed in another region. | Account for stored bytes, requests, retrieval, and outbound transfer charges. Prices and tiers vary by region and service. | Protect access credentials, test listing and deletion permissions, and document the exact backend configuration. |
| Local filesystem | Fastest while the disk is healthy. | No host separation; a disk, host, or ransomware event can destroy both source and backup. | Uses existing storage, but requires separate capacity and monitoring. | Useful as a staging or short-term copy, not as the only disaster-recovery destination. |
Whichever backend you choose, perform a test restore from a clean machine. A destination that accepts uploads but cannot list, download, or delete the required volumes is not operationally ready.
Write a root-owned backup script
Keep the command in a file owned by root or by a dedicated service account. A script makes paths, exclusions, logging, and exit handling reviewable and prevents a scheduler from silently using a different working directory.
Rank #3
- Ergonomic & Adjustable Design: Fight "text neck" and improve your posture. Designed for comfort, it offers an adjustable height (7.1in-8.5in) (1.4in adjustable range) and angle (5°-85°) Please note: cell phone stand is only 9 inches tall—the length of a standard pencil
- Without blocking subtitles Perfect for office desk Tiktok Face Time Zoom video—this is the ultimate kitchen desk essential for phones! Perfect viewing experience while reducing neck back strain, A must-have for gamers streamers desk, and anyone who values both style and support!
- Sleek & Stable Design fits Otterbox Case: Say goodbye to bent cables, tangles, and tip-overs! LISEN’s stylish adjustable desk phone holder features a built-in charging hole and smart cable management, keeping your phone secure and your workspace clutter-free cool gadgets for men
- ANTI-SLIP DESIGN free hands: The under 10.00 items easy gadgets back and the bottom of this kitchen essentials for women are fully covered by anti-skid silicone, which LISEN stand up desk decor can provide maximum protection device from any scratches and slides
- Your Perfect Viewing Companion:If your product arrives damaged or breaks within 365 days, reach out to LISEN for a quick and hassle-free solution. Struggling with assembly, like tightening the screw? We’ve got your back! Your experience matters to us. (Product including: phone Holder stand*1, screw*1, hexagon screwdriver*1, specification*1)
#!/usr/bin/env bash
set -Eeuo pipefail
SOURCE="/srv/data"
DEST="sftp://[email protected]/ubuntu-data"
KEY_ID="YOUR_GPG_KEY_ID"
LOG="/var/log/duplicity-srv-data.log"
exec >>"$LOG" 2>&1
echo "$(date --iso-8601=seconds) backup start"
PASSPHRASE='use-a-protected-secret-source' duplicity
--encrypt-key "$KEY_ID"
--full-if-older-than 1M
"$SOURCE" "$DEST"
status=$?
echo "$(date --iso-8601=seconds) backup exit $status"
exit "$status"The example follows Ubuntu’s documented pattern: the first invocation makes a full backup, later invocations are incremental, and --full-if-older-than 1M starts a new full chain when the previous full is more than one month old. Replace the placeholder passphrase with a protected secret mechanism; do not commit a real secret to this file.
Protect the script and its log
sudo chown root:root /usr/local/sbin/backup-duplicity
sudo chmod 700 /usr/local/sbin/backup-duplicity
sudo install -o root -g root -m 600 /dev/null /var/log/duplicity-srv-data.logLogs can contain destination names, filenames, and error details. Restrict them accordingly and configure log rotation so a failed job cannot fill the root filesystem.
Supply credentials safely
For SFTP, use a dedicated account and an SSH key whose permissions allow only the required backup path. Store the private key outside the source tree and set restrictive permissions. For object storage, use a dedicated identity limited to the backup bucket or prefix. Avoid putting access keys or GPG passphrases in shell history, unit files readable by other users, process listings, or world-readable configuration files.
If an environment variable is unavoidable, load it from a root-only file immediately before invoking Duplicity and unset it afterward. A secret manager or agent is preferable for long-lived unattended jobs.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
Schedule the job with cron
Cron is adequate when you want a simple recurring command and already have external monitoring.
Rank #4
- Easy Installation: Our gaming lights have been designed to enhance your entertainment experience. Simply position the led light bar next to your TV or game console to create a game room environment with ease. They come with USB power and a 60 inch cord for direct mounting and mobility
- Audio Syncing & Extensive Mode: The built-in high-sensitivity music sensor allows you to sync the TV led lights to your favorite music. Lights react and move to the beat of music, film and game audio, creating an incredible immersive sound and light experience – and all without the need for an additional hub. You can choose from 64+ patterns, including strobe, illusion, jump, energy, gradient, running, chasing, fluttering mode etc. Each mode can be applied to different scenes
- 64+ Chasing IC+RGB & W Effect: The independent control design of IC+RGB and white all-in-one multifunctional rgbw led bar lights monitor backlight allows you to easily switch the led lights for desk between IC+RGB and white to enjoy a variety of lighting effects, you can choose white lighting mode with high brightness for better illumination when working, etc. Choose IC+RGB lighting mode when you need to create an entertaining atmosphere for the light show, 16 million colours of Color changing rgb light bar let you dance to the beat and create a dynamic party atmosphere
- Dynamic and Dimmable Lights: 1%-full brightness free brightness adjustment gives you the flexibility to adjust dimmable led light bar for room decorations or a variety of occasions
- USB Powered: USB light bars for room can be powered by powernank, usb charger, TV, Monitor, laptop PC mainframe, making behind TV led lighting bar easy to install in any location.TV led lights are powered by the TV usb interface / PC mainframe, can be turned on/off synchronously with TV / PC
- Open root’s crontab:
sudo crontab -e - Run the script at a quiet time, for example every night at 02:30:
30 2 * * * /usr/local/sbin/backup-duplicity - Keep output in the script’s log and make sure a nonzero exit status reaches your monitoring system. Cron itself does not guarantee that anyone will read a failure email.
Stagger jobs that compete for disk, CPU, or network bandwidth. If the source changes during a run, application-consistent snapshots or quiescing may be required; Duplicity does not automatically provide database transaction consistency.
Schedule with a systemd timer
A systemd service and timer provide clearer status, dependency handling, and journal integration.
Service unit
[Unit]
Description=Encrypted Duplicity backup of /srv/data
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/backup-duplicity
User=root
Timer unit
[Unit]
Description=Run encrypted Duplicity backup nightly
[Timer]
OnCalendar=*-*-* 02:30:00
Persistent=true
[Install]
WantedBy=timers.target
- Save the units as
/etc/systemd/system/duplicity-backup.serviceand/etc/systemd/system/duplicity-backup.timer. - Reload unit definitions:
sudo systemctl daemon-reload - Enable and start the timer:
sudo systemctl enable --now duplicity-backup.timer - Inspect the next run and recent results:
systemctl list-timers duplicity-backup.timer sudo systemctl status duplicity-backup.service sudo journalctl -u duplicity-backup.service
Persistent=true allows a missed calendar run to be started after the machine returns. It does not replace alerting, and it can cause a large backup to begin immediately after a long outage, so account for available bandwidth and disk space.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesBack up the root filesystem without pseudo-filesystem failures
When backing up /, Ubuntu’s manpage warns that /proc must be excluded or Duplicity may crash on its unusual virtual entries. In practice, also review other runtime and device trees before selecting the entire root directory.
PASSPHRASE='use-a-protected-secret-source' duplicity
--encrypt-key YOUR_GPG_KEY_ID
--exclude /proc
--exclude /sys
--exclude /dev
--exclude /run
--exclude /tmp
--full-if-older-than 1M
/ sftp://[email protected]/ubuntu-rootDo not blindly exclude data that is required to rebuild the system. Package lists, service configuration, application data, user home directories, and boot configuration may need explicit inclusion. A root backup is not a substitute for documenting package installation, secrets, firewall rules, and service dependencies.
Best Value
- Compatible with Wide Screens - To ensure compatibility with the dual monitor mount, your each monitor must meet three conditions at the same time: First, computer screens size range: 13 to 32 inches. Second, screen weight range: 4.4 to 19.8 lbs. Third, the back of the monitor screen must have VESA mounting holes with a pitch of 75x75mm or 100x100mm.
- Regarding the compatibility with desks - Your desk must meet three conditions at the same time: First, desk material: Only wooden desks are recommended, plastic or glass desks cannot be used. Second, desk thickness range: 0.59" - 3.54". Third, the bottom of the desk should not have any cross beams or panels, as this will interfere with installation. We recommend carefully checking that your desk and monitors meets all above conditions before purchasing.
- Dual C-Clamp Hold - Worried your dual monitors might wobble or slip? Our upgraded base uses a larger platform plus a dual C-clamp structure to lock the dual monitor arm firmly to your desk. Each arm safely keeps your screens steady while you type, click and game—no shaking, no sliding, just a clean and secure setup you can trust every day. It also provides Grommet Mounting installation choice, both options ensure stable and secure fixation for your 0.59" - 3.54" desk.
- Full-Motion Adjustment For Comfortable View - Pull the screen closer when you’re deep in a spreadsheet, push it back to watch videos, or rotate to portrait for coding — moving everything smoothly with just one hand. The monitor stand offers +85°/-50° tilt, ±90° swivel and 360° rotation. Raise your monitor up to 15.75″ to support a healthy sitting posture. Whether you’re working from home, gaming through the night, or switching between video calls and documents, getting the screens to your natural line of sight helps relieve neck, shoulder and back strain so you can stay focused longer with less fatigue.
- Keep Your Desk Organized: By lifting both screens off the desktop, this dual monitor stand opens up valuable space for your keyboard, notebook, docking station or a simple, clutter-free work area. Built-in cable management guides wires along the arms, keeping cords out of sight and out of the way. Enjoy a tidy, modern workstation that looks as good as it feels to use.
Verify that an automated backup is usable
A successful upload proves only that Duplicity completed its write operation. Add independent checks.
- Check the scheduler result and alert on any nonzero exit code.
- Run a collection-status query against the destination to confirm that full and incremental volumes are visible:
duplicity collection-status sftp://[email protected]/ubuntu-data - Use Duplicity’s verification operation against a known destination when appropriate, and compare restored files with expected checksums or application-level validation.
- Monitor destination capacity, object-count or quota limits, SSH-key expiry, and object-storage credentials.
- Record the GPG fingerprint, Duplicity version, source paths, exclusions, destination URI, and retention policy in the recovery documentation.
Schedule a restore rehearsal. Restore a representative directory to a temporary location first, then perform a complete rebuild exercise at an interval that matches the importance of the data.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Restore files or rebuild a lost Ubuntu host
Restore a directory to a temporary location
- Install the same or a compatible Duplicity and GnuPG package on a clean Ubuntu system.
- Import the private GPG key and configure access to the destination. Confirm that the key fingerprint matches the documented recovery fingerprint.
- Create an empty restore directory:
mkdir -p /restore-test - Run the restore command, specifying the destination first and local target second:
duplicity restore sftp://[email protected]/ubuntu-data /restore-test - Inspect ownership, permissions, timestamps, and application files. Do not overwrite a live system until the recovered data has been validated.
To recover a particular point in time, use Duplicity’s time-selection options documented in the installed manpage, then validate that the selected chain contains the required files. Keep the private key available to GnuPG and provide its passphrase through the same protected method used for normal operations.
Rebuild after complete host loss
- Provision a clean Ubuntu host and apply security updates.
- Install Duplicity, GnuPG, and the backend client or SSH components required by the destination.
- Restore the private encryption key, signing key if used, and destination credentials from their separate recovery locations.
- Recreate the service account, destination access, and filesystem mount points.
- Run a test restore into a staging path, then restore the required data into its final paths.
- Reinstall applications and reapply configuration using the recovered files and your system documentation.
- Start services only after checking ownership, permissions, secrets, and database consistency.
- Re-enable the scheduled job and perform one successful backup before closing the incident.
If the destination is unavailable, try the documented alternate copy rather than repeatedly changing commands. A disaster procedure should state the exact destination URI, key locations, account names, and contacts needed by someone who did not configure the original host.
Retention and safe cleanup
Retention should follow the oldest restore point you promise to keep. Duplicity exposes cleanup actions including remove-older-than, remove-all-but-n-full, and remove-all-inc-of-but-n-full. These commands can delete volumes that later incremental chains require.
A cautious cleanup sequence
- Write down the restore horizon and the full chains that must remain.
- Run
duplicity collection-statusand inspect the destination inventory. - Perform a restore test from the oldest chain you plan to retain.
- Only then run the selected removal command against the correct destination.
- Run collection status again and check that the retained chain is complete.
Do not combine an aggressive cleanup command with a first-time automation rollout. Start with a conservative retention period, observe storage growth, and shorten it only after a successful restore and a documented decision.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteQuick Recap
Troubleshoot common failures
GPG reports a missing key or cannot decrypt
- Confirm that the restore account has the private key, not only the exported public key.
- Compare the key fingerprint with the value recorded when the job was created.
- Check that
GNUPGHOME, key-file permissions, and the gpg-agent socket point to the intended account. - For an encrypted unattended job, verify that the passphrase source is available without interactive input.
The job works manually but fails under cron or systemd
- Use absolute paths and set required environment variables explicitly.
- Confirm the scheduler’s user, home directory, SSH key, GnuPG home, and network availability.
- Read the service journal or redirected log and check the actual exit status.
- Run the script as the scheduler’s account with a minimal environment before changing the backup command.
SFTP authentication or upload errors
- Test a plain SSH/SFTP connection using the same account and key.
- Check remote directory ownership, quota, host-key verification, and firewall rules.
- Ensure the destination URI names the intended path and that the account can list existing Duplicity volumes.
Object-storage requests fail
- Verify that the configured identity can list, read, write, and delete only the required prefix.
- Check region, endpoint, clock synchronization, and request or transfer limits.
- Confirm that lifecycle rules are not deleting Duplicity volumes before your retention horizon.
Backing up / crashes or hangs
- Exclude
/procas Ubuntu documents, then review/sys,/dev,/run, and other transient trees. - Check available local temporary space and destination capacity.
- Split high-churn application data into a dedicated job if one enormous source makes recovery and monitoring impractical.
Security and recovery checklist
- Use a dedicated backup account and least-privilege destination permissions.
- Encrypt with a GPG public key and protect the private key and passphrase offline and separately from the Ubuntu host.
- Use
--sign-keywhen an authenticity signature is part of your threat model. - Never put real passphrases in shell history, source code, world-readable files, or unprotected unit definitions.
- Make the script, key directories, SSH keys, and logs readable only by the required account.
- Keep at least one destination remote from the source host and, when required, remote from its geographic site.
- Alert on nonzero exit status, stale last-success time, destination capacity, and credential expiry.
- Test a file restore and a full-host recovery, including installation of the exact backend access needed.
- Run a restore test before any destructive retention cleanup.
- Document the Duplicity version, key fingerprints, exclusions, schedules, destination URI, and recovery contacts.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
