The reliable pattern is to run Duplicity from a root-owned script, encrypt each archive with a GnuPG key, send the encrypted volumes to storage such as SFTP or S3, and invoke the script from a systemd timer or cron. The first run is a full backup; later runs are incremental unless --full-if-older-than 1M starts a new full chain.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
Automation is only recoverable if the private GPG key, its passphrase, and destination credentials are preserved separately from the Ubuntu host. Test a restore before pruning old chains, and exclude /proc when the source is the root filesystem.
As an Amazon Associate I earn from qualifying purchases.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
What Duplicity and GPG actually do
Duplicity packages files into tar-format volumes, uses librsync to represent changes efficiently, encrypts (and optionally signs) those volumes with GnuPG, and then writes them to a local or remote backend. Encryption happens before the files leave the Ubuntu machine, so a storage operator can hold the objects without being able to read their contents when your private key remains under your control.
Ubuntu’s Noble manpage identifies the packaged release as duplicity 2.1.4-3ubuntu2. The exact package can differ on another Ubuntu release or after an update, so check the installed version with:
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
duplicity --versionA normal backup set consists of one full chain followed by incremental volumes. The first successful run creates the full set. Subsequent runs contain changes since the previous run, reducing transfer and storage work. The option --full-if-older-than 1M starts another full backup when the previous full is more than one month old; the M is Duplicity’s month interval, not a promise that a run will occur exactly on a calendar date.
Decide the recovery design before automating
Choose what must survive
- Source scope: Back up an application directory such as
/srv/data, or define a carefully reviewed set of system paths. A root-filesystem backup needs exclusions for virtual filesystems. - Recovery point: Decide how far back a restore must reach before choosing retention. A short retention window cannot restore an older incident.
- Recovery location: Store the encrypted volumes away from the Ubuntu host. A second disk on the same server helps with accidental deletion but does not protect against loss of that server.
- Key custody: Keep the GPG private key, passphrase, and any signing key in a separate recovery location. Without the decryption key, the uploaded volumes cannot be restored.
Install the packages
sudo apt update
sudo apt install duplicity gnupgRun the installation and subsequent configuration as an administrator, but give the backup job only the filesystem access it actually needs. A job reading protected application data may need to run as root; a service-account job is safer when the source does not require root access.
Free tools Windows power users keep installed
One-click scans. No signup required.
Give the job a stable identity
Use one GPG key for the backup identity rather than whichever personal key happens to be present in an operator’s home directory. Record the key fingerprint, not just the short key ID. Put scripts under a root-owned directory such as /usr/local/sbin, make them writable only by root, and keep secret files in a directory such as /etc/duplicity with mode 700.
Create and preserve the GPG key
Generate an encryption key
On a secured administration session, create a dedicated key:
gpg --full-generate-keyChoose an algorithm and expiry policy that match your organization’s key-management rules, give the key a recognizable identity, and protect it with a strong passphrase. Find the long key ID and fingerprint with:
gpg --list-secret-keys --keyid-format LONGUse the long ID shown for the backup key in --encrypt-key. If you also need authenticity verification, specify a signing key with --sign-key; signing does not replace encryption and creates another piece of key material that must be recoverable.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchExport a recovery copy
gpg --export --armor YOUR_GPG_KEY_ID > /root/backup-public-key.asc
gpg --export-secret-keys --armor YOUR_GPG_KEY_ID > /root/backup-private-key.asc
chmod 600 /root/backup-private-key.ascMove the private-key export and the passphrase to a protected recovery location that is not mounted permanently on the server. Keep a record of the fingerprint so that, after a disaster, you can verify that the imported key is the intended one. The public key can be distributed to systems that create backups; the private key should be imported only where restores are authorized.
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
Make unattended decryption possible
Duplicity documents --use-agent for connecting to gpg-agent. An unattended timer still needs a way to unlock the key: an agent with an appropriate noninteractive setup, or a protected secret mechanism supplied by your operating environment. Do not put a real passphrase directly in a command typed at a shell prompt, a unit file, or a script committed to source control. Shell history and process inspection can expose it.
Build a repeatable backup script
The following example backs up /srv/data to an SFTP server. Replace the key ID, account, host, path, and secret mechanism. The illustrated passphrase file is readable only by root; an agent-based arrangement can omit the PASSPHRASE export entirely.
#!/usr/bin/env bash
set -euo pipefail
SOURCE=/srv/data
DEST='sftp://[email protected]/ubuntu-data'
PASSPHRASE=$(< /etc/duplicity/passphrase)
export PASSPHRASE
trap 'unset PASSPHRASE' EXIT
duplicity
--use-agent
--encrypt-key YOUR_GPG_KEY_ID
--full-if-older-than 1M
"${SOURCE}"
"${DEST}"Create the secret file through a root session, set ownership to the account that runs the job, and apply mode 600:
Recommended Free Tools
sudo install -d -m 700 /etc/duplicity
sudo install -m 600 /dev/null /etc/duplicity/passphrase
sudo chown root:root /etc/duplicity/passphraseDo not leave the example text in that file. If the job runs as another service account, change ownership deliberately and ensure no unrelated user can read it. A protected environment or secret-store integration is preferable to a static file when your platform provides one.
Install the script and perform a foreground test before scheduling:
sudo install -o root -g root -m 700 duplicity-backup /usr/local/sbin/duplicity-backup
sudo /usr/local/sbin/duplicity-backupWatch the output and verify that encrypted volumes appear at the destination. The first run can be large; do not treat an interrupted first run as a usable full chain until a subsequent status check succeeds. On later runs, confirm that only changed data is being transferred and that the command exits with status zero.
Backing up the root filesystem
If the source is /, Ubuntu’s manpage specifically warns that Duplicity can crash while reading the unusual entries under /proc. Add an exclusion before the source argument:
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
duplicity
--use-agent
--encrypt-key YOUR_GPG_KEY_ID
--full-if-older-than 1M
--exclude /proc
/
'sftp://[email protected]/ubuntu-root'Review other dynamic mounts and application caches for your system as well; the correct exclusion list depends on what must be rebuilt versus what must be restored. Never exclude a directory merely because it is large until you have documented how it will be recovered.
Signing as well as encrypting
Encryption hides contents. Signing lets a restore process verify that volumes were produced by the expected key and were not modified. Add --sign-key YOUR_SIGNING_KEY_ID when that assurance is required, and preserve the signing private key and its passphrase under the same recovery discipline as the encryption key.
Schedule the job with systemd
A systemd timer gives you a named service, journal logs, and a clear failure status. Create /etc/systemd/system/duplicity-backup.service:
[Unit]
Description=Encrypted Duplicity backup
Wants=network-online.target
After=network-online.target
[Service]
Type=oneshot
ExecStart=/usr/local/sbin/duplicity-backupCreate /etc/systemd/system/duplicity-backup.timer:
[Unit]
Description=Run encrypted Duplicity backup daily
[Timer]
OnCalendar=*-*-* 02:30:00
Persistent=true
[Install]
WantedBy=timers.targetEnable and start the timer:
sudo systemctl daemon-reload
sudo systemctl enable --now duplicity-backup.timer
systemctl list-timers duplicity-backup.timerPersistent=true causes a missed calendar run to be started when the machine comes back up. It does not make a failed backup successful: the service must still return a nonzero status when Duplicity reports an error.
Inspect a run with:
sudo systemctl start duplicity-backup.service
sudo systemctl status duplicity-backup.service
sudo journalctl -u duplicity-backup.service --since 'today'Send nonzero results to an alerting system. A timer that silently fails is not a backup strategy. Keep enough log context to identify the source, destination, key ID, start time, and exact error without recording secret values.
Cron alternative
Cron is suitable when you already operate cron-based monitoring. Put a root-owned entry in /etc/cron.d/duplicity-backup so the account is explicit:
30 2 * * * root /usr/local/sbin/duplicity-backup >> /var/log/duplicity-backup.log 2>&1Use a full path to the script, assume a minimal environment, and rotate or otherwise protect the log. Whichever scheduler you choose, the script must return Duplicity’s failure status so monitoring can act.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
Choose SFTP, S3, or local storage
Duplicity supports local file URLs, SFTP/SCP and rsync-over-SSH, Amazon S3, and other backends. The right destination is the one your recovery procedure can reach and authenticate to after the Ubuntu host is gone.
| Destination | Recovery and separation | Access-control model | Cost and retention considerations | Restore prerequisites |
|---|---|---|---|---|
| SFTP or SCP over SSH | Usually straightforward file access; place the server in a different host or location to survive loss of the Ubuntu machine. Speed depends on the network and server. | SSH account, key or password policy, directory permissions, and the server’s host-key verification. | Provider storage and transfer pricing vary. Files can be removed with Duplicity retention commands, subject to the account’s permissions. | Network route, working SSH credentials, verified host key, Duplicity, and the GPG private key. |
| Amazon S3 | Object storage is physically separate from the source host; restore speed depends on network throughput, request behavior, and the service region. | Bucket policy and the credentials or role used by the Duplicity backend. | Storage, request, retrieval, and transfer charges depend on the chosen service and region; no universal price applies. Object lifecycle rules must not delete volumes needed by a Duplicity chain. | Backend credentials, bucket access, Duplicity’s S3 support, and the GPG private key. |
| Local filesystem | Fast when attached, but a disk in the same host or room does not provide host or geographic separation. | Unix ownership and filesystem permissions. | Retention is under your control, but capacity and disk failure are your responsibility. | The disk or mount, correct path, Duplicity, and the GPG private key. |
For either remote choice, GPG encryption protects archive contents from the storage operator. It does not protect the destination credentials, the existence and timing of backups, or an accidentally deleted volume. Use least-privilege accounts and verify that the destination cannot be altered by ordinary application users.
SFTP destination syntax
sftp://[email protected]/ubuntu-dataUse a dedicated remote directory and verify the SSH host identity before the first unattended run. If the destination path contains characters with URL meaning, apply the escaping required by the backend rather than guessing at a different path.
S3 destination syntax
s3://bucket-name/ubuntu-dataConfigure the credentials using the mechanism supported by your Duplicity installation and cloud environment. Do not paste access keys into the script or expose them in a world-readable service environment. Confirm that lifecycle policies retain every full and incremental volume for the complete restore window.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Retention: remove data only after a restore test
A Duplicity incremental chain depends on its full volume and the incremental volumes that follow it. Deleting one required volume can make an apparently present backup unusable. First perform a restore to a temporary directory and verify representative files; only then automate destructive cleanup.
Quick wins for a faster PC:
Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Common retention actions include:
# Remove volumes older than six months
duplicity remove-older-than 6M --force DESTINATION
# Keep the newest two full chains
duplicity remove-all-but-n-full 2 --force DESTINATION
# Keep increments associated with the newest two full chains
duplicity remove-all-inc-of-but-n-full 2 --force DESTINATIONReplace DESTINATION with the exact backend URL. Run these commands under the same credentials and GPG setup as the backup job, and record what policy you selected. Retention should reflect the business recovery requirement, not simply the amount of free space today.
Cloud lifecycle deletion and remote-server quotas can remove files outside Duplicity’s knowledge. Coordinate those policies with the full-chain interval and the oldest restore point you promise.
Restore files, a host, or an entire backup set
Check the collection before writing data
On the backup host or a clean recovery machine, install Duplicity and GnuPG, import the private key, verify its fingerprint, and recreate destination access. Then inspect the collection:
gpg --import backup-private-key.asc
gpg --list-secret-keys --keyid-format LONG
duplicity collection-status 'sftp://[email protected]/ubuntu-data'
duplicity list-current-files 'sftp://[email protected]/ubuntu-data'Collection status reveals whether the destination contains a coherent full and incremental history. A successful listing does not prove every file is readable, so continue with a real restore test.
Restore the latest data
mkdir -p /restore/test
duplicity restore
'sftp://[email protected]/ubuntu-data'
/restore/testThe destination is read and decrypted, and the restored files are written under /restore/test. Restore to a new directory first so that existing files cannot be overwritten accidentally.
Restore a point in time
duplicity --time 2026-10-01T00:00:00
restore
'sftp://[email protected]/ubuntu-data'
/restore/october-01The requested timestamp must be covered by the retained full and incremental volumes. If retention has removed that chain, Duplicity cannot reconstruct the older state.
Restore one file
duplicity --file-to-restore etc/example.conf
'sftp://[email protected]/ubuntu-data'
/restore/example.confThe path is relative to the backed-up source. For a root backup, do not add an extra leading slash to the path passed to --file-to-restore.
Recover after the original server is lost
- Provision a clean Ubuntu system with enough temporary storage and network access to the backend.
- Install
duplicityandgnupg, then import the preserved private key and verify its fingerprint. - Recreate the SFTP, S3, or local-backend credentials without copying secrets from the failed host.
- Run
collection-statusand a small restore to prove that the key and destination access work. - Restore the required data into a staging path, check ownership and permissions, and then place files into service-specific locations.
- Rebuild the scheduled script and timer only after the restore has been validated; otherwise the replacement host may overwrite the evidence you still need.
If the only copy of the private GPG key or its passphrase was on the lost server, the encrypted archives are not recoverable through Duplicity. This is why key escrow and a documented recovery copy are part of the backup design, not optional administration.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Scan for outdated or missing drivers - takes under a minute3Clear out junk files and repair common Windows errorsTroubleshoot the failures that matter
GPG reports a missing key or cannot decrypt
- Confirm that the private key, not only the public key, is imported on the restore machine.
- Compare the key fingerprint with your recovery record and ensure the key ID in the script is correct.
- Check that the agent is available to the account running the timer, or that the protected passphrase mechanism is readable by that account.
- Do not generate a replacement key and assume it can decrypt old volumes; encryption is tied to the original key.
The remote backend rejects the job
- Test the SFTP connection or S3 authorization interactively as the same Unix account used by the scheduler.
- Check destination spelling, remote-directory permissions, bucket policy, and expired credentials.
- For SSH, verify the host key in the account’s known-hosts configuration rather than disabling host verification.
- Confirm that the destination still contains all volumes in the current chain and has free capacity.
A root backup crashes while scanning files
Check that /proc is excluded when the source is /. Also review mounts that represent live kernel or runtime state and decide explicitly whether they belong in a restorable filesystem image.
Quick Recap
The timer appears to run but no backup is usable
- Inspect
systemctl statusand the journal for the service, not only the timer’s next-run time. - Run the script manually with the same account and environment.
- Ensure the script has executable permissions and absolute paths.
- Alert on nonzero exit status and periodically verify that new volumes are arriving at the destination.
- Perform scheduled test restores; a growing collection of files is not evidence that the key, chain, and restore procedure all work.
Operational checklist
- Record the installed Duplicity version and the GPG key fingerprint.
- Keep the private key, passphrase, and signing key in a separate recovery location.
- Use a root-owned script or a deliberately limited service account.
- Supply destination credentials through protected files, an agent, or an approved secret store; never through shell history.
- Use
--full-if-older-than 1Mor another interval that matches your recovery objectives. - Exclude
/procwhen backing up/. - Schedule with a monitored systemd timer or cron job and preserve useful logs.
- Keep remote storage separate from the Ubuntu host and review access permissions.
- Test both a single-file restore and a larger recovery before enabling destructive retention.
- Apply retention only after deciding the oldest restore point you must preserve.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
