Backup (Sysadmin Toolkit)

For database-specific backup tooling see Postgres HA and the web-dev backup page. This page is the host / volume / cluster perspective.

File-level backup tools (encrypted, deduplicated)

• ★ restic — Go binary; encrypted; deduplicated; supports S3 / R2 / B2 / GCS / SFTP / many. The default for new setups.
• ★ borg — Python; encrypted; deduplicated; very mature.
• Kopia — Go; modern; nice UI option; faster than borg in some workloads.
• Duplicacy — proprietary; lock-free dedup; commercial license required for some uses.
• Bup — git-style backups; older.

Hosted / managed companions

• BorgBase — hosted borg repo storage.
• rsync.net — generic SFTP-accessible storage; popular for restic / borg.
• Cloudflare R2 / Backblaze B2 / Wasabi — cheap S3-compatible targets.
• AWS S3 + lifecycle to Glacier — long-term cheap archive.

Kubernetes-native

• ★ Velero — backup k8s resources + PV snapshots; restore across clusters. The default.
• Kasten K10 — paid; rich UI; great for stateful workloads.
• Stash — open-source backup operator.
• VolumeSnapshot + restore — built into k8s; CSI driver-dependent.

Image / VM-level

• Proxmox Backup Server — for Proxmox hypervisors; deduplicated; remote sync.
• Veeam — enterprise heavyweight.
• Bareos / Bacula — old-school enterprise backup; still around.
• BackupPC — server-pull backup; classic homelab choice.

Enterprise / heavyweight

• Bacula / Bareos — for tape libraries / massive estates.
• Amanda — long-running.
• Commvault / Veeam / Rubrik — paid; enterprise.

What good backup looks like

• ★ 3-2-1 rule — 3 copies, 2 different media, 1 off-site.
• Encrypted at rest — restic / borg do this by default.
• Tested restores — quarterly; otherwise it's a hope.
• Automated — cron / systemd timer / k8s CronJob.
• Retention policies — daily for 7 days, weekly for 4 weeks, monthly for 12 months. Adjust to your RPO.
• Off-host / off-cloud copies — for disaster scenarios where the provider is the disaster.

Common patterns

Single VPS:

• restic to R2 nightly.
• Lifecycle policy on R2 deletes old copies.
• Restore drill: monthly script, restores into a temp dir, reports success.

Self-host fleet:

• Each box runs restic to a shared B2 / R2 bucket with prefixes per host.
• Plus DB-level WAL archiving for important data.

Kubernetes:

• Velero scheduled backups daily; PV snapshots + manifests to R2.
• Database operators (CloudNativePG) handle their own.
• Quarterly restore drill into a fresh cluster.

Homelab:

• Proxmox Backup Server on a separate box / NAS.
• Replicate offsite via pbs-sync to a second PBS at a friend's house or cloud.

Restore RTO / RPO planning

• RTO (recovery time objective) — how long until you're back up. Drives how fast restores must be.
• RPO (recovery point objective) — how much data you can afford to lose. Drives backup frequency.
• Document both. Test against them quarterly.

Patterns to adopt

• ★ Encrypted off-host copies — anything else isn't a backup.
• Restore drill cadence — monthly for prod, quarterly for everything else.
• Multiple targets — restic / borg can write to two repos in different providers.
• Don't rely on snapshots alone. Snapshots help for fat-finger; off-host backups help for the host dying.
• Automate it. Backups people remember to run get forgotten.

Pick this if…

• Default file backup, free: restic → R2 / B2.
• Default file backup, hosted target: restic → BorgBase / rsync.net.
• k8s: Velero.
• Proxmox / VMs: Proxmox Backup Server.
• Large enterprise: Veeam (paid) or Bareos (OSS).
• Database-specific: see Postgres HA for WAL-G.