Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →The dependable way to back up a Linux VPS with restic is to create an encrypted repository on storage separate from the server, export databases before scanning files, schedule locked backups, and prove recovery with real restore drills. Restic protects repository contents with client-side encryption, but it cannot make an active database transaction consistent or stop someone who can delete the repository. The procedure below covers repository setup, path selection, automation, retention, security, and rebuild testing.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a restic VPS backup does—and does not do
Restic reads the filesystem paths you specify and writes encrypted, content-addressed snapshots to a repository. A repository can be a local directory, an SFTP destination, or Amazon S3/S3-compatible object storage. Because encryption and authentication happen on the client, the storage operator does not need the plaintext contents or the repository password.
As an Amazon Associate I earn from qualifying purchases.
A filesystem scan is not an application-consistent backup. If a database is writing while restic reads its files, the resulting files may not represent a usable transaction boundary. Export each database with its native dump utility, or briefly quiesce the service, and include the resulting dump directory in the restic backup. For a game-server VPS, this usually means stopping or pausing the server long enough to flush world and player-save files, then dumping any separate database used for accounts, maps, or telemetry.
Restic also cannot protect a repository from an administrator who is allowed to delete or overwrite it. Separate storage credentials, geographic copies, append-only controls, or object locking are needed for that threat. A successful restic check confirms repository structure and integrity; only a restore followed by application and database validation demonstrates that the VPS can actually be recovered.
#1 Best Overall
- Read Before You Buy — No Video Output: These adapters support charging and USB 2.0 data transfer, but cannot transmit video signals. Except for standard USB webcams (which use USB data only), they are not compatible with HDMI/DisplayPort cables, video-capable USB-C hubs, or docking stations with video output.
- Convert USB-A Ports to USB-C: Designed to connect USB-C earphones, cables, flash drives, card readers, and other USB-C accessories to standard USB-A ports. Plug-and-play with no drivers or software required.
- Aluminum Alloy Housing: Built with a sturdy aluminum alloy shell that aids in heat dissipation and protects against daily wear and scratches. Designed to maintain a stable and secure connection.
- Compact & Travel-Friendly: The ultra-compact design allows the adapter to stay plugged into your device without blocking adjacent ports or adding bulk, reducing wear and tear on your original USB ports.
- 12-Month Warranty: Backed by a 12-month manufacturer warranty for peace of mind. Designed to meet strict quality control standards for reliable everyday performance.
Choose storage that is independent of the VPS
Do not initialize the only repository on the VPS you are trying to protect. A host failure, account suspension, filesystem corruption, or attacker with root access could remove both the live data and its backup. Use an external repository for the primary copy and, where the data matters, maintain another copy or an immutable retention layer.
| Destination | Separation and access | Security and durability controls | Cost and restore behavior | Operational considerations |
|---|---|---|---|---|
| Local external storage, such as an external USB backup drive | Strong against a VPS-host failure when physically detached; weak if it remains connected or is stored in the same place. | Restic encryption protects contents; the drive itself needs access control and an independent password record. | Usually predictable storage cost and fast local restores; capacity and physical handling are limiting factors. | Requires mounting, monitoring, and an off-site rotation plan. Useful as a second copy even when the primary repository is remote. |
| SFTP repository | Runs on a different host under an account restricted to the repository path. | Use SSH-key authentication for automation. Limit the key and account so they cannot administer the VPS. The SFTP host should provide its own snapshots or immutable controls if available. | Bandwidth and storage are billed or limited by the SFTP service; restore speed depends on the network link and server. | Simple directory semantics and straightforward troubleshooting, but you must maintain the remote account, host-key trust, and capacity. |
| S3-compatible object storage | Separate service and account boundary; a bucket can be in another region or provider. | Use a bucket credential scoped only to the backup bucket. Object-lock or append-only retention, when supported, reduces deletion risk. Restic still encrypts data before upload. | Recurring storage charges are generally capacity-based; requests, egress, and cross-region retrieval can add restore cost. Restore latency depends on bandwidth and object-service behavior. | Highly scalable and geographically flexible, but requires careful lifecycle, credential, and egress-policy management. |
An off-site SFTP or S3-compatible repository is the stronger primary choice against loss of the VPS host. A detached external drive is practical for a local or second copy. Whichever destination you choose, record its endpoint, account owner, region, retention settings, and the person or team authorized to retrieve it.
Prepare the VPS and the recovery secrets
Install restic and establish a root-only configuration
Install restic from the package source appropriate to your Linux distribution, then verify the installed version and that the executable is available to the account that will run backups. Create a directory readable only by root for runtime configuration:
install -d -m 0700 /etc/restic
The repository password is the key to every snapshot. Keep the canonical password in an independent secret manager, an offline recovery record, or another location that does not depend on the VPS. A root-readable password file on the VPS can support unattended jobs, but it must not be the only copy. The restic project documentation warns: “Losing your password means that your data is irrecoverably lost.”
Store endpoint and credential material in root-owned files with mode 0600, or inject them from a secret manager at job start. Do not put the password in a world-readable shell script, a shared environment file, a ticket, or command history. Repository credentials should not be capable of administering the VPS itself; use a separate storage account with the narrowest permissions that still allow backup and restore.
Set the repository variables
For unattended operation, define RESTIC_REPOSITORY or RESTIC_REPOSITORY_FILE, plus RESTIC_PASSWORD_FILE. A repository URL is an address, not a local mount that must be exposed to the application. For S3-compatible storage, the endpoint and bucket path are supplied in the URL:
Recommended Free Tools
Rank #2
- 5-in-1 USB-C Hub: Experience comprehensive connectivity featuring a Power Delivery input, two USB-A 2.0 ports, a USB-A 3.0 port, and an HDMI port. (Note: The USB-C power delivery input port is only for connecting an external wall charger to power your laptop and cannot power peripheral devices.)
- 90W Pass-Through Charging: Achieve optimal charging with 90W pass-through power to your laptop, supported by a total input of 100W, with the hub reserving 10W for operational efficiency. (Note: Wall charger not included.)
- Quick Data Transfers: Accelerate your productivity with rapid data transfers using a high-speed 5Gbps USB 3.0 port and two 480Mbps USB 2.0 ports.
- 4K HDMI Display: Enhance your visual experience with a hub capable of delivering 4K resolution at 30Hz in both mirror and extend modes. Please note that this hub is compatible with MacBook (macOS 12 and newer), Windows 10 and 11, ChromeOS, and laptops equipped with DP Alt Mode and Power Delivery. Note: This device is not compatible with Linux.
- What You Get: Anker USB-C Hub (5-in-1, 4K HDMI), welcome guide, 18-month warranty, and our friendly customer service.
export RESTIC_REPOSITORY='s3:https://s3.example.com/vps-backups'
export RESTIC_PASSWORD_FILE='/etc/restic/password'
restic init
Run restic init once, against the empty destination. It creates the repository metadata and encryption configuration. If the command reports that a repository already exists, stop and verify the endpoint and password rather than initializing another location accidentally.
Configure SFTP without an interactive prompt
An SFTP repository can use a URL such as:
export RESTIC_REPOSITORY='sftp:user@host:/srv/restic-repo'
export RESTIC_PASSWORD_FILE='/etc/restic/password'
restic init
Configure SSH-key authentication for the backup account and verify host-key checking before scheduling the job. The key should be restricted to the repository account and, where the server supports it, limited to the required path and operations. Test a non-interactive connection as the same system user that will run the timer or cron job; a job that waits for an SSH password or host-key confirmation is not automated.
Inventory what the VPS must recover
Make a service-by-service inventory before choosing paths. Include the files that define the machine and the data that cannot be recreated from a clean install:
- System and service configuration:
/etc, service unit files, firewall rules, reverse-proxy configuration, and deployment scripts. - Users and SSH access: relevant portions of
/home, authorized keys, scheduled jobs, and application-owned configuration. Handle private keys and secrets according to your security policy. - Application data: directories under
/srv,/opt, or another deployment location, including uploads and game-server worlds. - Container data: selected Docker or container volume directories, such as
/var/lib/docker/volumes, when those volumes contain irreplaceable state. - Database exports: a dedicated directory such as
/var/backups/db, populated immediately before the restic run. - TLS material: certificates and private keys where policy permits, with a documented method for reissuing them if they are intentionally excluded.
Do not blindly include every byte on the root filesystem. Caches, package-manager downloads, build artifacts, logs with no retention value, temporary files, and other reproducible data increase upload time and repository size without improving recovery. Exclusions should be explicit and reviewed whenever the application layout changes. If a path is excluded, document how it will be regenerated during a rebuild.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quiesce services and export databases first
Create the dump directory with restrictive permissions and run each database’s native export command immediately before the filesystem backup:
install -d -m 0700 /var/backups/db
# Run the database's native dump command here, writing into /var/backups/db.
Use a consistent naming convention, include the database and date in filenames, and remove expired dump files according to a policy that still leaves enough snapshots for the restic retention window. Check the dump command’s exit status; do not run restic as though the backup were complete when the export failed.
Rank #3
- Sleek 7-in-1 USB-C Hub: Features an HDMI port, two USB-A 3.0 ports, and a USB-C data port, each providing 5Gbps transfer speeds. It also includes a USB-C PD input port for charging up to 100W and dual SD and TF card slots, all in a compact design.
- Flawless 4K@60Hz Video with HDMI: Delivers exceptional clarity and smoothness with its 4K@60Hz HDMI port, making it ideal for high-definition presentations and entertainment. (Note: Only the HDMI port supports video projection; the USB-C port is for data transfer only.)
- Double Up on Efficiency: The two USB-A 3.0 ports and a USB-C port support a fast 5Gbps data rate, significantly boosting your transfer speeds and improving productivity.
- Fast and Reliable 85W Charging: Offers high-capacity, speedy charging for laptops up to 85W, so you spend less time tethered to an outlet and more time being productive.
- What You Get: Anker USB-C Hub (7-in-1), welcome guide, 18-month warranty, and our friendly customer service.
For stateful game servers, use the server’s save or stop mechanism so world files are flushed before restic reads them. Pause writes, perform the database dump, and resume the service only after the dump has completed. If a service cannot be paused, use its documented hot-backup facility and test the resulting restore. Restic itself has no knowledge of transactions, locks, or application-level consistency.
Run and inspect the first backup
Start with the smallest complete path set, then expand it after verifying the restore process. A representative command is:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchrestic backup /etc /home /srv /var/lib/docker/volumes /var/backups/db
--exclude-caches
--tag vps
Replace these paths with the services actually hosted on your VPS. Add further --exclude rules for known cache or ephemeral directories, and keep the exclusion file under version control or in a documented administration directory so another operator can reproduce the policy. Use tags to distinguish this VPS from other machines sharing a repository.
On the first run, watch the output for permission errors, unreadable sockets, disappearing files, and unexpectedly large directories. A nonzero exit status is an incident to investigate, not a successful backup. After the command completes, confirm that a snapshot exists:
restic snapshots
Check the snapshot’s timestamp, host, tags, and paths. Repeat the command after a controlled change, such as creating a test file in an included directory, to confirm that the expected data is captured.
Automate backups without overlap
Use a systemd service and timer
A systemd service keeps the command, environment, and exit status explicit; a timer controls when it runs. Put repository variables in a root-readable environment file, for example /etc/restic/backup.env, with mode 0600:
Rank #4
- Dual Converters, Infinite Potential：Includes 2× USB C male to USB A female adapters and 2× USB A male to USB C female adapters. Perfect for a wide range of uses—tablets with Bluetooth keyboards, expand USB ports on macbook, and more. Two different converters for all your daily needs
- Next-Level 10Gbps & 3A Charging: No more slow 480Mbps, this usb to usb c adapter has a transfer speed of up to 10Gbps, allowing you to do more transferring in less time. This usb adapter fits both USB A and USB C charger, supporting up to 3A fast charging
- Upgraded Exquisite Craftsmanship: With an aluminum alloy housing and metal connector, the usbc to usb adapter is extremely durable and sturdy. Rigorously tested to withstand more than 10,000 times of plugging and unplugging, ensuring long-lasting performance
- Broad Compatible: The usb c to usb adapter widely supports all USB C/ USB A devices like laptops, tablets, cellphones, car chargers, and phone chargers. Such as compatible with MacBook Pro/Air 2023/2022, Thunderbolt 4/3 Devices,Apple MagSafe Watch 9/8/7/SE/Ultra, iPad Pro 2022/2021, Samsung Galaxy S23/S20/S10, and iPhone 17/16/15 Pro. Plug and play
- Please Note: To reach 10Gbps speed, keep the cable under 3.3 ft. For USB A Male to USB C adapters, try flipping the USB C connector. USB C Male to USB A adapters support bidirectional 10Gbps transfer within 3.3 ft
RESTIC_REPOSITORY=s3:https://s3.example.com/vps-backups
RESTIC_PASSWORD_FILE=/etc/restic/password
Create a service that runs the database-export wrapper and then restic. The wrapper should stop on errors, create the dump directory, quiesce the relevant services, perform dumps, and release the services even when the backup fails. A representative unit is:
[Unit]
Description=Restic VPS backup
After=network-online.target
Wants=network-online.target
[Service]
Type=oneshot
EnvironmentFile=/etc/restic/backup.env
ExecStart=/usr/local/sbin/vps-backup
Use a timer with a schedule appropriate to the VPS’s change rate and recovery-point objective:
[Unit]
Description=Run the restic VPS backup
[Timer]
OnCalendar=*-*-* 03:15:00
Persistent=true
[Install]
WantedBy=timers.target
Enable and start the timer, then inspect its next run and journal output. The wrapper or service should prevent concurrent executions, for example with a lock such as flock. Capture exit status and send an alert when the service fails, runs unusually long, or produces no new snapshot within the expected interval.
Use cron only with an explicit lock
A carefully configured cron job is acceptable when systemd is unavailable. Invoke a script with absolute paths, load the protected environment file, and wrap the operation in a lock so a slow upload cannot overlap the next run. Redirect output to a monitored log and alert on nonzero status. Cron does not provide the same journal and dependency handling as systemd, so verify that the network is available before starting and that failures are visible to an operator.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Check repository health and apply retention
Run the following maintenance sequence regularly, preferably outside the busiest backup window:
restic snapshots
restic check
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12
# Review the forget dry-run/output and repository policy before pruning.
restic prune
restic snapshots lists what exists. restic check examines repository structure and integrity and should be scheduled as an ongoing health check. It does not boot a restored VPS, replay a database, or prove that an application can use its files.
Best Value
- 5-in-1 Connectivity: Equipped with a 4K HDMI port, a 5 Gbps USB-C data port, two 5 Gbps USB-A ports, and a USB C 100W PD-IN port. Note: The USB C 100W PD-IN port supports only charging and does not support data transfer devices such as headphones or speakers.
- Powerful Pass-Through Charging: Supports up to 85W pass-through charging so you can power up your laptop while you use the hub. Note: Pass-through charging requires a charger (not included). Note: To achieve full power for iPad, we recommend using a 45W wall charger.
- Transfer Files in Seconds: Move files to and from your laptop at speeds of up to 5 Gbps via the USB-C and USB-A data ports. Note: The USB C 5Gbps Data port does not support video output.
- HD Display: Connect to the HDMI port to stream or mirror content to an external monitor in resolutions of up to 4K@30Hz. Note: The USB-C ports do not support video output.
- What You Get: Anker 332 USB-C Hub (5-in-1), welcome guide, our worry-free 18-month warranty, and friendly customer service.
forget changes which snapshots are retained according to the policy; it does not immediately remove all unreferenced data. Review its dry-run or output, confirm that the daily, weekly, and monthly coverage matches the business requirement, and verify that the correct host and tags are selected. Only then run prune, which removes repository data no longer needed by retained snapshots. Pruning can consume substantial I/O and bandwidth, so schedule it separately if it competes with backup windows.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsRetention numbers are an example policy, not a universal rule. Extend the windows for systems with audit, legal, or long-running recovery requirements, and account for the storage cost of database dumps and rapidly changing game worlds.
Prove recovery with restore drills
The restic README’s operational message is direct: “Much more important than backup is restore.” Make restore testing a recurring requirement, not a one-time setup task.
Test a single important file
- List snapshots and select a known-good snapshot ID or use
latestafter confirming its host and tag. - Restore into a disposable directory, never over the live application:
restic snapshots
restic restore latest --target /var/tmp/restic-restore-test
sha256sum /var/tmp/restic-restore-test/path/to/important-file
- Compare the checksum or file contents with the expected source, inspect ownership and permissions, and remove the temporary directory when the test is complete.
Perform a clean-directory application test
Restore configuration, uploads, and a representative game world into an isolated directory or disposable machine. Start the application against that restored data, confirm that it reads configuration, loads user content, and writes a new save. Import one database dump with the database’s native restore command and verify representative records. Record the snapshot ID, paths restored, validation results, date, and observed recovery time.
Run a full VPS rebuild drill
- Provision a disposable instance with the intended Linux distribution and enough storage for the restored data.
- Install restic and retrieve the repository endpoint and password through the documented recovery process, not from an undocumented personal account.
- Restore system configuration and application data into the new instance, then reinstall packages and service dependencies.
- Import the database dump, restore file ownership and permissions, and start services in dependency order.
- Verify that the application or game server starts, that players or internal clients can connect, and that new writes persist.
- Measure elapsed time and note missing prerequisites, manual decisions, or credentials that were unavailable.
Update the runbook after every drill. A restore that succeeds only because the original VPS is still available is not an independent recovery test.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Security limits and ways to reduce deletion risk
Restic encrypts and authenticates repository data before it leaves the VPS, but an attacker who controls the VPS can potentially read the repository password if it is stored there and can use permitted storage credentials to delete backup data. Keep the authoritative password outside the server, separate backup credentials from VPS administration credentials, and limit the storage account to the repository.
Where the backend supports it, enable append-only behavior or object-lock retention. Maintain geographic separation for a second copy, and restrict who can change lifecycle and deletion policies. Test that the backup account cannot log in to the VPS or alter unrelated buckets and directories. These controls complement restic; none replaces an independent restore test.
Quick Recap
Troubleshoot the failures that matter
- “Repository does not exist” or an unexpected empty repository: verify
RESTIC_REPOSITORY, endpoint spelling, bucket or path, and the account used by the scheduled job. Do not runinituntil you know you are targeting the intended destination. - Password errors: confirm the password file’s permissions, trailing newline handling, and that the scheduled service can read it. Retrieve the canonical password from the independent recovery record rather than guessing.
- SFTP waits forever: test SSH-key authentication and host-key verification non-interactively as the service user. Remove interactive password prompts from the job.
- Backups are unexpectedly huge or slow: inspect the largest included directories, add justified exclusions for caches and reproducible artifacts, and avoid backing up duplicate generated data.
- Database restore fails: check the dump command’s exit status and format, ensure the database was quiesced or exported consistently, and perform an import test before relying on the dump.
- Overlapping jobs or missed alerts: add a lock, inspect timer or cron logs, alert on nonzero exit status, and alert when no fresh snapshot appears within the required interval.
checkpasses but the service will not start: treat this as an application-recovery problem. Restore into a clean environment, reinstall dependencies, fix ownership and configuration, and test the database import and service startup.
A concise operating runbook
- Confirm the repository is on separate storage and that the independent password record is accessible to authorized responders.
- Run database exports and quiesce stateful services as required.
- Run the locked restic backup for reviewed paths with cache and ephemeral-data exclusions.
- Inspect the exit status and run
restic snapshotsto confirm a fresh snapshot. - Run scheduled
restic checkand investigate every error. - Review
forgetoutput against the retention policy, then runprunein a planned maintenance window. - Perform single-file, application, and full-rebuild restore drills on a recurring schedule, recording recovery time and correcting the runbook.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
