Guides / Backups

Back up your server with restic

natbox plans do not include managed backups, so keep your own copy of anything important. This guide uses restic, which encrypts your backups and only sends what changed.

1. Install restic

apt update
apt install -y restic

On AlmaLinux, install epel-release first, then use dnf install -y restic. On Alpine, use apk add restic.

2. Choose where backups go

Use somewhere other than the server itself. This guide uses another machine you can reach over SSH, such as a computer at home or a second server. Set up SSH keys first, so backups can run without a password.

Create the backup store. Replace the user, host and folder with your own:

export RESTIC_REPOSITORY=sftp:user@your-backup-host:/backups/natbox
export RESTIC_PASSWORD_FILE=/root/.restic-password
openssl rand -base64 32 > /root/.restic-password
chmod 600 /root/.restic-password
restic init

Save the password somewhere safe, away from this server. Without it, your backups cannot be read by anyone, including you.

3. Make a backup

restic backup /etc /home /root /var/www

Add any other folders you use. For a database, dump it to a file first and back up that file. For example, with PostgreSQL:

sudo -u postgres pg_dumpall > /root/postgres.sql

4. Run it every night

Create /root/backup.sh:

#!/bin/sh
export RESTIC_REPOSITORY=sftp:user@your-backup-host:/backups/natbox
export RESTIC_PASSWORD_FILE=/root/.restic-password
restic backup /etc /home /root /var/www
restic forget --keep-daily 7 --keep-weekly 4 --prune

Then run it daily with cron:

chmod 700 /root/backup.sh
(crontab -l 2>/dev/null; echo "30 3 * * * /root/backup.sh") | crontab -

5. Test a restore

A backup you have never restored is only a hope. Try this now, not after something goes wrong:

restic snapshots
restic restore latest --target /tmp/restore-test
ls /tmp/restore-test

Delete /tmp/restore-test when you are done.

Before you reinstall or cancel a server, copy off anything you need. A cancelled server is deleted with all its data.