Automated Server Backups with BorgBackup and Borgmatic on Linux

A practical guide to encrypted, deduplicated server backups using BorgBackup and Borgmatic on Linux.

If you run a home lab, VPS, or self-hosted services, backups are not optional. Most traditional backup tools either consume excessive disk space by storing full copies or rely on complex script setups to manage incrementals.

BorgBackup (Borg) solves this with chunk-based deduplication, compression, and client-side authenticated encryption. Borgmatic adds a clean YAML configuration layer on top, turning complex Borg CLI commands into a simple, maintainable service.

Here is how to set up an automated, encrypted backup system using BorgBackup and Borgmatic on Linux.

Why BorgBackup and Borgmatic?

Borg operates at the chunk level rather than the file level. When you back up updated files or databases, Borg splits data into variable-sized chunks and only stores chunks it has not seen before. This makes daily backups fast and space-efficient.

Key advantages include:

Client-side encryption: Data is encrypted with AES-256 before leaving your server.
Deduplication: Multiple backups of similar data consume minimal extra storage.
Borgmatic simplicity: Instead of managing long shell scripts with complex flags, a single declarative YAML file defines source directories, database dumps, retention rules, and remote locations.

Prerequisites

Before starting, ensure you have:

A Linux server (Debian, Ubuntu, Fedora, or Arch).
Root or sudo access.
A backup target location. This can be a secondary local disk, an offsite server via SSH, or a managed Borg host such as BorgBase.

If you are using a remote server via SSH, generate an SSH key pair dedicated to backups:

ssh-keygen -t ed25519 -a 100 -f ~/.ssh/id_ed25519_borg -C "borg-backup"

Copy the public key to your backup destination's authorized_keys file.

Step 1: Install BorgBackup and Borgmatic

On Debian or Ubuntu systems:

sudo apt update
sudo apt install borgbackup borgmatic -y

On Fedora or RHEL:

sudo dnf install borgbackup python3-borgmatic

On Arch Linux:

sudo pacman -S borg borgmatic

Verify the installation:

borg --version
borgmatic --version

Step 2: Initialize the Encrypted Repository

Create a directory or SSH path for your repository. For local testing, use /var/backups/borg-repo. For remote storage, use user@backuphost:/var/backups/borg-repo.

Initialize the repository with passphrase-based repokey encryption:

borg init --encryption=repokey-blake2 /var/backups/borg-repo

Enter and confirm a passphrase when prompted. Store this passphrase in a password manager. If you lose it, your backup data cannot be recovered.

Step 3: Configure Borgmatic

Borgmatic uses a declarative YAML configuration file located in /etc/borgmatic/config.yaml or /etc/borgmatic/d/.

Generate a configuration file:

sudo mkdir -p /etc/borgmatic
sudo borgmatic config generate -c /etc/borgmatic/config.yaml

Edit /etc/borgmatic/config.yaml with your settings:

location:
  source_directories:
    - /etc
    - /var/www
    - /home/user/data

  repositories:
    - /var/backups/borg-repo
    # For remote SSH target:
    # - ssh://user@backuphost:22/var/backups/borg-repo

  one_file_system: true

storage:
  encryption_passphrase: "YOUR_SUPER_SECRET_PASSPHRASE"
  compression: lz4
  ssh_command: ssh -i /root/.ssh/id_ed25519_borg

retention:
  keep_daily: 7
  keep_weekly: 4
  keep_monthly: 12

consistency:
  checks:
    - repository
    - archives
  check_last: 3

hooks:
  sqlite_databases:
    - name: main
      path: /var/lib/sqlite/app.db

Validate your configuration syntax:

sudo borgmatic config validate

Test a manual backup run:

sudo borgmatic create --verbosity 1 --progress

Step 4: Automate Backups with Systemd

Borgmatic ships with systemd service and timer files on most distributions.

Check if the systemd timer is available:

sudo systemctl status borgmatic.timer

If the unit files are missing, create /etc/systemd/system/borgmatic.service:

[Unit]
Description=borgmatic backup
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/bin/borgmatic --syslog-verbosity 1

Create /etc/systemd/system/borgmatic.timer:

[Unit]
Description=Run borgmatic backup daily

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

Enable and start the timer:

sudo systemctl daemon-reload
sudo systemctl enable --now borgmatic.timer

Verify scheduled execution times:

sudo systemctl list-timers borgmatic.timer

Step 5: Verify and Perform a Test Restore

A backup is only as reliable as its restore process. Never assume backups work without testing restoration.

List existing archives in the repository:

sudo borgmatic list

To extract a specific file or directory from an archive to a temporary directory:

mkdir -p /tmp/restore-test
cd /tmp/restore-test

# List contents of a specific archive
sudo borg list /var/backups/borg-repo::your-hostname-2026-08-23T08:00:00

# Extract a path
sudo borg extract /var/backups/borg-repo::your-hostname-2026-08-23T08:00:00 etc/nginx

Alternatively, mount the entire backup repository as a FUSE filesystem to inspect files interactively:

mkdir -p /mnt/borg-mount
sudo borg mount /var/backups/borg-repo /mnt/borg-mount

# Inspect files
ls -la /mnt/borg-mount

# Unmount when done
sudo borg umount /mnt/borg-mount

Best Practices for Security and Reliability

Follow the 3-2-1 Rule: Keep 3 copies of important data, on 2 different media types, with 1 offsite copy.
Export the Borg Key: If you use repokey encryption, export a backup copy of the key file so you can recover data if repository metadata gets corrupted:
```
sudo borg key export /var/backups/borg-repo ~/borg-key-backup.txt
```
Isolate SSH Keys: Use restricted SSH keys on remote storage hosts so an attacker gaining access to the source server cannot erase old remote backups.
Monitor Log Output: Check journalctl -u borgmatic.service regularly or configure health check hooks in config.yaml to receive alerts if a backup fails.