Bulletproof Disaster Recovery: Automating Encrypted Backups Using BorgBackup on Linux

A common misconception in server management is that RAID constitutes a backup. It does not. RAID protects against hardware drive failure, but it will seamlessly and instantly replicate accidental file deletions, corrupted database tables, or ransomware encryption across all your mirrored drives.

For true disaster recovery on your Bare Metal Servers, you need an isolated, versioned, and encrypted backup strategy.

Enter BorgBackup (Borg). Borg is an open-source, deduplicating backup program that offers authenticated encryption. It only stores the changes made since your last backup, saving massive amounts of disk space.

Step 1: Install BorgBackup

This guide uses Ubuntu 24.04 LTS. Run as root:

bash
apt update
apt install -y borgbackup
borg --version
Step 2: Initialize the Encrypted Repository
A "repository" is where Borg stores your archives. We will create a local repository at /backup/borg-repo.

Bash
mkdir -p /backup/borg-repo
borg init --encryption=repokey /backup/borg-repo
You will be prompted to enter a passphrase. Do not lose this passphrase.

Step 3: Running Your First Backup
Let's back up /var/www/html and /etc:

Bash
borg create --stats --progress \
    /backup/borg-repo::"Backup-{now:%Y-%m-%d_%H:%M}" \
    /var/www/html /etc
Step 4: Automating Backups with a Bash Script & Cron
Create a bash script: nano /usr/local/bin/borg-backup.sh

Bash
#!/bin/bash
export BORG_PASSPHRASE="YOUR_SUPER_SECRET_PASSPHRASE"
REPOSITORY="/backup/borg-repo"
LOG="/var/log/borg-backup.log"

echo "Starting backup: $(date)" >> $LOG

borg create --stats \
    $REPOSITORY::"Auto-Backup-{now:%Y-%m-%d_%H:%M}" \
    /var/www/html /etc >> $LOG 2>&1

borg prune --list --keep-daily=7 --keep-weekly=4 $REPOSITORY >>$LOG 2>&1

echo "Backup finished: $(date)" >> $LOG
Make it executable and add to crontab to run at 2:00 AM:

Bash
chmod +x /usr/local/bin/borg-backup.sh
crontab -e
# Add: 0 2 * * * /usr/local/bin/borg-backup.sh
Step 5: How to Restore Your Data
List available archives:

Bash
borg list /backup/borg-repo
Extract the files into a recovery folder:

Bash
mkdir /tmp/recovery && cd /tmp/recovery
borg extract /backup/borg-repo::"Auto-Backup-2026-06-01_02:00"
Conclusion
To fulfill the 3-2-1 backup strategy, you must move these backups off-site. Pushing your encrypted Borg repositories to a secure London Data Centre ensures true disaster recovery.

Read the original tutorial here: https://www.eservers.uk/tutorials/howto/automate-encrypted-backups-borgbackup-linux/