The safest Linux VPS backup plan uses several layers: native database dumps for logical recovery, versioned file backups for configuration and application data, and provider or filesystem snapshots for fast rollback. Keep at least one backup outside the VPS and preferably outside the provider’s failure domain, encrypt the repository, retain multiple points in time, monitor every job, and regularly prove that restores work.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
What a complete VPS backup contains
A VPS backup is not one command or one snapshot. It is a recovery system designed for different failures. A bad deployment may need an instant rollback; a corrupted database may require a clean logical restore; ransomware or an account compromise may require a copy that the VPS and its provider cannot delete.
As an Amazon Associate I earn from qualifying purchases.
Use three complementary layers:
- Logical database exports: PostgreSQL dumps, MySQL dumps, or MariaDB dumps recreate database objects and data on a clean server.
- Versioned file backups: A tool such as restic records multiple snapshots of configuration, application files, uploads, deployment artifacts, and database dump files. You can restore one file or an entire tree.
- Provider or filesystem snapshots: A VPS-provider snapshot, LVM snapshot, ZFS snapshot, or Btrfs snapshot gives a rapid rollback point, but it must not be your only copy.
Think in terms of recovery point objective (RPO)—how much recent data you can afford to lose—and recovery time objective (RTO)—how quickly service must return. Frequent database exports and continuous WAL archiving can reduce RPO; local snapshots and a documented rebuild procedure can reduce RTO.
How the backup layers differ
| Method | Consistency and recovery point | Restore granularity | Storage independence | Operational trade-off |
|---|---|---|---|---|
| PostgreSQL, MySQL or MariaDB logical dump | Consistent when the database’s native procedure and options are used | Individual database, objects, tables or rows after loading into a target | Can be copied to any independent repository | Portable and easy to inspect, but a large restore can take longer than a volume rollback |
| Restic file repository | Versioned snapshots of selected paths; consistency of live database files is not guaranteed | One file, directory or complete application tree | Local repositories plus SFTP, REST, Amazon S3, MinIO, Wasabi, Backblaze B2, Azure Blob Storage, OpenStack Swift and rclone-backed services | Scheduling, credentials, pruning and monitoring are your responsibility |
| Provider, LVM, ZFS or Btrfs snapshot | Fast point-in-time rollback; database consistency depends on quiescing and storage semantics | Usually a volume or whole VPS | Often shares the provider, account, region or disk failure domain until exported | Fast recovery, but weak protection against provider, account and ransomware failures |
Plan the files and recovery dependencies
Begin with an inventory rather than backing up every byte on the server. Record where the operating system, application code, uploads, databases, TLS keys and service definitions live. A practical set commonly includes:
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
/etc, including SSH, firewall, web-server, service and package configuration.- Application directories such as
/var/wwwand any custom deployment path. - Persistent uploads, user-generated media, queues and other data that is not reproducible from source control.
- systemd unit files, timer definitions, cron entries and deployment scripts.
- TLS certificates and private keys, stored with strict permissions and encrypted in the repository.
- Database dump files created in a protected staging directory immediately before the file-backup job.
Exclude caches, temporary build output and reproducible package caches unless your recovery procedure specifically requires them. Exclusions reduce storage and restore time, but verify that an excluded directory can genuinely be rebuilt. Keep a written list of required packages, runtime versions, DNS changes, firewall rules and secrets so a new VPS can be reconstructed without relying on a damaged disk.
Back up files with restic
Restic runs when invoked; it is not a background daemon. Schedule it with cron or a systemd timer. Its repositories support local storage and several remote backends, including SFTP, REST, S3-compatible services, Azure Blob Storage, OpenStack Swift and rclone-backed destinations. Keep a local repository for speed and an independent off-site repository for provider, disk or account compromise scenarios.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →1. Create and protect a repository
Use a dedicated backup account or storage location, restrict repository credentials, and keep the encryption password outside the VPS when possible. A local repository can be initialized like this:
export RESTIC_REPOSITORY=/srv/restic-repository
export RESTIC_PASSWORD_FILE=/root/.config/restic/password
restic initFor an SFTP repository, set RESTIC_REPOSITORY to the SFTP repository address supported by your restic installation. Store the password file with mode 600, limit who can read SSH keys, and never place repository passwords in a world-readable script.
2. Stage database exports, then capture the file set
Create a directory that only the backup process can read, write each database dump there, and run restic after the dumps finish. Include configuration, application paths, persistent data and the staging directory in one snapshot:
install -d -m 700 /var/backups/db
restic backup /etc /var/www /var/lib/my-app /var/backups/dbUse restic exclude rules for caches and transient build directories after confirming they are reproducible. Add tags such as daily or vps-production if you operate more than one repository or retention class. A successful command is not proof that the expected data was included, so check the output and verify that dump files exist before starting the backup.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
3. Verify integrity and retention
Run an integrity check on a schedule and after repository migration:
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
restic checkAfter a successful backup, apply a documented retention policy with restic forget and restic prune. A sample policy might keep seven daily, four weekly and twelve monthly snapshots; change those periods to match the business requirement and storage budget. Do not prune immediately after a failed backup. Alert on non-zero exit status, repository-lock errors, missing dump files and storage-capacity thresholds.
4. Restore either selected files or the complete tree
List snapshots, inspect their contents and restore to a temporary directory before overwriting production:
restic snapshots
restic restore latest --target /restore-test
restic restore latest --include /etc/ssh/sshd_config --target /restore-one-fileCheck ownership, permissions, symbolic links, extended attributes and service configuration after restoring. A file repository can return an application tree, but it does not turn an unprepared live database directory into a consistent database backup.
Free tools Windows power users keep installed
One-click scans. No signup required.
PostgreSQL: use dumps, globals and WAL appropriately
PostgreSQL’s documentation warns that a direct file-system copy is usable only when the database server is shut down. Copying a running data directory with a normal file backup can capture an internally inconsistent state.
Routine logical recovery with pg_dump
Export each database with pg_dump and export cluster-wide roles and other global objects separately:
pg_dump -Fc app_database > /var/backups/db/app_database.dump
pg_dumpall --globals-only > /var/backups/db/postgresql-globals.sqlThe custom format produced by -Fc can be restored selectively with PostgreSQL’s restore tools. Keep the globals file because roles, tablespace definitions and permissions are not contained in an individual database dump. Include both files in the off-site restic backup and record the PostgreSQL major version and the options used.
Large databases and tighter recovery points
For larger recovery-point requirements, use PostgreSQL’s continuous archiving and WAL procedure. Document how to make a base backup, where WAL segments are archived, how long they are retained and the exact restore sequence. A file-system backup is typically larger than an SQL dump because pg_dump can recreate indexes instead of copying their contents.
Do these 3 things before closing this tab:
1Scan for outdated or missing drivers - takes under a minute2Clear out junk files and repair common Windows errors3Fix the driver behind crashes, sound loss and screen glitchesRank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Consistent volume snapshots
A correctly implemented consistent volume snapshot can be taken while PostgreSQL runs, but the complete cluster and its WAL context must be retained. If data, WAL or tablespaces span volumes, snapshots need to be simultaneous; independent snapshots can represent different moments and fail during recovery. When in doubt, take a native dump before the snapshot or stop and quiesce the database according to the storage platform’s procedure.
Restore test
On a clean scratch PostgreSQL instance, restore globals first, create or select the target database, load the dump, and verify roles, extensions, permissions, sequences and application queries. Measure the elapsed restore time and record required packages and configuration changes.
MySQL and MariaDB: logical dumps and transaction boundaries
MySQL documents mysqldump as a logical backup that emits SQL statements capable of recreating database objects and table data. A typical dump that preserves commonly needed programmable objects is:
mysqldump --single-transaction --routines --events --triggers app_database > /var/backups/db/app_database.sqlWhen –single-transaction is appropriate
For InnoDB tables, --single-transaction provides a consistent online view without blocking ordinary reads and writes, subject to MySQL’s documented DDL restrictions. It does not make nontransactional MyISAM or MEMORY tables consistent. Lock, quiesce or separately handle those tables, and record the exact server version and dump options.
Run the dump with an account that can read every required object. Protect the output because it contains application data and may contain sensitive values. Check that the expected SQL file is non-empty and that the command exited successfully before restic starts.
Restore into a clean target
Create a clean target database and feed the dump to the client:
mysql app_database < /var/backups/db/app_database.sqlThen test users, grants, routines, events and triggers when the application depends on them. A dump that restores tables but omits permissions or scheduled events is not a complete application recovery.
Windows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstallOutdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchRank #4
- High capacity in a small enclosure – The small, lightweight design offers up to 6TB* capacity, making WD Elements portable hard drives the ideal companion for consumers on the go.
- Plug-and-play expandability
- Vast capacities up to 6TB[1] to store your photos, videos, music, important documents and more
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Use snapshots for speed, not as your only backup
A provider snapshot or LVM, ZFS or Btrfs snapshot is valuable after an unsafe deployment, accidental deletion or configuration mistake. It can return an entire volume quickly, often faster than rebuilding from logical dumps and files.
Snapshots remain vulnerable to the same provider, account credentials, region, disk or failure domain as the VPS. Ransomware or an attacker with control of the account may delete them. Keep an exported copy or a separate restic repository outside that boundary and retain more than the newest point.
Before taking a snapshot, create a database-native dump when practical. Otherwise quiesce writes and follow the storage platform’s documented consistency method. PostgreSQL specifically cautions that snapshots across separate volumes may not be simultaneous. Treat a snapshot as a rapid rollback image, not evidence that database files are logically recoverable.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.Automate ordering, retention and alerting
The safe order is database export first, file backup second, snapshot third when a snapshot is part of the plan. This ensures the restic repository contains the newest completed dumps rather than yesterday’s files.
Use a systemd timer or cron
Run a script that performs these checks in order:
- Create the protected staging directory and remove only obsolete dump files from the previous successful run.
- Run PostgreSQL and MySQL or MariaDB export commands, stopping on any non-zero exit status.
- Verify that each expected dump exists, has a plausible size and is readable by the backup process.
- Run restic against configuration, application, persistent-data and dump paths.
- Record the snapshot identifier and send an alert if any command fails.
- Run retention pruning only after the backup completes successfully.
Systemd timers provide explicit service dependencies and journal logs; cron is also suitable when the script handles locking, logging and notification. Prevent overlapping runs with a lock so a slow upload cannot start a second dump or prune job.
Choose retention from the business requirement
Keep daily, weekly and monthly points according to how far back you may need to investigate corruption, fraud or ransomware. A short retention window saves storage but can preserve only the damaged state. Longer retention costs more and may increase object-storage retrieval or egress charges, so document the trade-off rather than silently deleting old points.
Encrypt and isolate credentials
Restic encrypts repository contents, but access to the repository password and backend credentials still determines whether an attacker can destroy or read backups. Use separate credentials, least-privilege storage policies, restricted network access and an off-site copy that the VPS cannot rewrite. Keep encryption keys and recovery instructions available to authorized operators during an incident.
Best Value
- Plug-and-play expandability
- SuperSpeed USB 3.2 Gen 1 (5Gbps)
Rehearse restoration before a real failure
A backup is only useful when it restores. Periodically use a scratch VPS, isolated VM or other disposable environment to test the complete path. Do not test only whether a command can list snapshots.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Minimum restore drill
- Restore one individual configuration or application file and confirm its owner and permissions.
- Restore one complete application tree and start its services with the documented packages and environment variables.
- Restore one PostgreSQL database plus roles and cluster-wide objects.
- Restore one MySQL or MariaDB database and verify grants, routines, events and triggers.
- Restore from the off-site copy, not only the local repository or provider snapshot.
Record restore duration, network and storage prerequisites, DNS and TLS steps, firewall changes, secrets retrieval and every manual command. Compare the measured time with the required RTO. If a drill exposes a missing credential, incomplete dump or permission error, fix the automation and repeat the test.
Recovery paths for common failures
Bad deployment or accidental deletion
Use the newest verified provider or filesystem snapshot for the fastest rollback when its consistency is acceptable. If only a few files changed, restore those paths from a restic snapshot instead of replacing the whole VPS.
Database corruption
Stop application writes, preserve the damaged system for investigation, and restore the database into a clean target from the latest known-good native dump. For PostgreSQL environments with WAL archiving, follow the documented base-backup and WAL procedure to reach a point before corruption.
Disk failure
Create a replacement VPS, install the required operating-system and runtime packages, restore configuration and application files from the off-site restic repository, and load database dumps. Recreate DNS, firewall rules, TLS certificates and service accounts, then validate the application before switching traffic.
Ransomware or account compromise
Assume snapshots and credentials on the affected provider are compromised. Isolate the VPS, rotate secrets, use the independent off-site repository, and restore into a clean account or provider when necessary. Do not reconnect the restored system until malware indicators and unauthorized keys have been addressed.
Quick Recap
Operational checklist
- Native dumps run successfully for every production database.
- PostgreSQL globals, MySQL grants and application-specific objects are included.
- Configuration, service definitions, uploads and deployment artifacts are in the file set.
- Caches and reproducible files are excluded deliberately, not accidentally.
- Restic repositories are encrypted, checked and copied outside the VPS.
- Snapshots have a documented consistency procedure and retention policy.
- Jobs alert on failures, missing dumps, locks and low storage.
- Restore drills cover files, complete application trees and both database engines.
- Restore time, required packages, DNS, TLS, firewall and secret-handling steps are written down.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
