How to Back Up a VPS with Restic and Backblaze B2

Verdict: The cheapest reliable VPS backup in 2026 is Restic writing encrypted, deduplicated snapshots to a Backblaze B2 bucket. You get offsite copies, sub-hourly restore, and a bill that usually stays under a few dollars a month for a typical server. Set it up once with a cron job and a retention policy, then forget about it.

Why a VPS Needs Its Own Backup Plan

Your VPS provider might promise redundant storage, but redundancy is not a backup. RAID protects against a single disk failing on their side. It does not protect against a bad deploy you pushed at 2 a.m., a database you dropped by accident, or a ransomware infection that encrypts the mounted volume. If the provider snapshots your disk, those snapshots often live in the same account and the same region as the server itself.

I once watched a client lose a staging database because an automated migration script ran against the wrong host. The provider’s snapshot was only an hour old, so the data was gone anyway. A real backup lives somewhere your server cannot quietly corrupt, and it keeps history so you can roll back to before the mistake, not just to the most recent snapshot.

The practical goal is simple: keep encrypted copies of your important data in a separate account, retain several versions, and make restore a command you can run without thinking.

Also Read:

How to Self-Host a Password Manager with Vaultwarden

What Makes Restic a Good Fit

Restic is a single static binary that handles four things most backup tools get wrong. It encrypts every chunk with AES-256, so your data is unreadable without the password. It deduplicates, meaning if a file barely changes between runs, only the changed chunks are stored again. It is incremental by default, so the second backup is far faster than the first. And it supports many backends, including local disks, SFTP, and S3-compatible object storage such as B2. The official Restic documentation walks through every backend and command if you want the full reference.

Because the repository is just a folder of encrypted chunks, you can point Restic at B2 and treat the cloud bucket like a remote drive. Restoring means mounting or extracting a snapshot, not praying that a provider’s panel works during an outage.

Restic stores each backup as a snapshot. A snapshot captures the state of your paths at a moment in time. You can list snapshots, diff two of them, and restore any single file from any snapshot. That granularity is why it beats a flat mirror copy, where overwriting a file destroys the only version you had. You can also mount a snapshot as a read-only filesystem with restic mount, which is handy when you want to browse old versions before pulling anything out.

Also Read:

How to Set Up WireGuard VPN on a Linux VPS

Set Up a Backblaze B2 Bucket

Create a B2 bucket in the Backblaze dashboard. Give it a private type so the contents are not publicly readable. Then generate an application key scoped to that bucket only. You will receive a key ID and an application key. Write both down in your password manager, because the application key is shown only once.

B2 pricing is what makes this approach attractive. Storage runs at about six dollars per terabyte per month, and you get free egress up to three times your average monthly storage volume. Egress beyond that is one cent per gigabyte. The Backblaze B2 pricing page lists the current rates and the free egress allowance, so check it before you size the bucket. For a server with a few hundred gigabytes of data and occasional restores, the monthly cost is often under two dollars. Compare that with running a second always-on VPS just to hold copies.

Keep the bucket in a region close to your server to lower latency, but do not confuse bucket region with safety. The point is account separation: if your VPS host or your server itself is compromised, the B2 bucket in a different provider stays intact.

Also Read:

How to Set Up Uptime Kuma on a VPS

Install Restic and Initialize the Repository

Install Restic from your distribution’s package manager. On Debian or Ubuntu the command is sudo apt install restic. On Fedora use sudo dnf install restic. The binary has no dependencies, so you can also download the official release and drop it into /usr/local/bin. Source and release notes live on the Restic GitHub repository if you prefer a specific version.

Export the credentials Restic needs as environment variables so they are not typed into shell history:

export B2_ACCOUNT_ID="your-key-id"
export B2_ACCOUNT_KEY="your-application-key"
export RESTIC_REPOSITORY="b2:your-bucket-name:/vps-backup"
export RESTIC_PASSWORD="a-long-unique-passphrase"

Also Read:

Linux VPS Security Rules: 7 Steps to Harden SSH Access

Initialize the repository once:

restic init

Restic creates the encrypted repository structure in your bucket. From this point every command targets that repository using the same four environment variables. If you are already comfortable with a hardened SSH setup on your VPS, treat these exports the same way: keep them in a root-owned file with tight permissions, not in a world-readable script.

Run Your First Backup

Back up the paths that actually matter. For most servers that means /etc for configuration, /var/www or your app directory for code, and database dumps you export first. Always dump databases to a file before backing them up, because backing up a live database file can capture it mid-write.

A first run looks like this:

restic backup /etc /var/www /root/db-dumps

Restic scans the files, chunks and encrypts them, and uploads only the new data. The first backup uploads everything. Later backups upload almost nothing for unchanged files, which is why daily runs stay cheap and fast.

List what you have with restic snapshots. Restore a single file with restic restore latest --include /var/www/config.php --target /tmp/restore. The restored file lands in /tmp/restore, so you can inspect it before moving it back into place. I keep a note of these two commands in my runbook, because during an incident you do not want to read documentation under pressure.

Keep History Without Filling the Bucket

Unlimited snapshots sound nice until the bill arrives. Restic’s forget command applies a retention policy and prunes the chunks those deleted snapshots no longer need. A common policy keeps 7 daily, 4 weekly, and 6 monthly snapshots:

restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Run this after each backup. The --prune flag actually frees space in the bucket. Without it, forgotten snapshots leave orphaned chunks behind. If you are new to deploying services with Docker Compose, back up the compose files and the volumes directory so a rebuild starts from known good state.

Automate It with Cron and Watch the Result

A backup you run by hand is a backup you will forget. Put the environment exports, the backup command, and the forget command into a single root script, then call it from cron:

0 3 * * * /root/vps-backup.sh >> /var/log/vps-backup.log 2>&1

This runs the job every night at 3 a.m. server time. The log file is your audit trail: if a run fails, the error is waiting there in the morning.

Add a lightweight check so silence does not hide failure. A simple approach appends a success line and sends it to a monitoring tool, or you can pair the job with a self-hosted status page such as the one covered in our Uptime Kuma setup guide. The key is that a missed backup produces a visible alert, not a silent gap.

Test a restore before you trust the system. Too many people verify only that the backup command exits cleanly, then discover during a real emergency that a path was excluded. Restore a file to a temp directory once a month. Fifteen minutes of practice beats a panic at 3 a.m.

How Restic Compares to Other Options

Restic is not the only tool, but it sits in a sweet spot for most VPS owners. The table below compares the common choices.

Borg delivers tighter deduplication, but it is Linux only and needs rclone to reach B2. The Borg documentation covers its compression and append-only modes if you manage large, mostly static datasets. rclone is excellent for moving files but it mirrors rather than versions, so a corrupted file overwrites the good copy. A second VPS gives you a copy, not version history, and it usually costs more per month than B2 storage. Restic gives you encryption, history, and cheap offsite storage in one tool.

Final Takeaway

Backing up a VPS sounds like a chore until the day you need a file back. Restic plus B2 turns that chore into a nightly cron job that costs pocket change and survives provider outages, bad deploys, and accidental deletes. Encrypt the repository, keep a sane retention policy, and prove the restore works at least once.

Start with one server and one bucket this week. Back up /etc and your app directory, confirm a snapshot exists, then restore a test file to /tmp. Once that loop is closed, extend the same script to every server you run. If you host sites behind a reverse proxy, also glance at our Nginx Proxy Manager guide so the config you protect is the config you actually serve. Keep the RESTIC_PASSWORD in a separate secret store from the server itself; if both live on the same disk, a single compromise loses the key and the data together. Your future self, mid-incident at 3 a.m., will thank you.