How do I use a storage VPS for off-site backups?

What does a backup VPS give you that RAID or a snapshot does not?

A backup VPS holds a separate, versioned copy of your data in another building, reached with its own credentials. That is the one property the usual stand-ins lack. Disk redundancy keeps a server running through a failed drive; it does not undo a deletion, ransomware or a lost account, so it is not a backup. A snapshot sits on the same disks as the server it captures, so it can roll back a mistake but it is not an off-site copy.

In searches, "backup VPS" means two things: backing a VPS up elsewhere, and using a VPS as the place backups land. It is one job seen from either end: a production server pushes Borg or restic archives to a storage VPS exactly as a laptop does.

Why is one storage VPS not a 3-2-1 backup?

Because 3-2-1 counts copies, media and places, and one VPS is one copy in one place. The rule, as US-CERT's paper Data Backup Options sets it out, is three copies of every important file, on two different media types, with one copy stored off-site. One storage VPS is one copy in one place. The 3-2-1 rule asks for three copies, on two kinds of media, with one of them off-site: a storage VPS fits as that off-site copy, next to two you keep yourself.

A layout that satisfies it for a home lab or a small team:

• Copy 1: the live data on your laptop, server or NAS.
• Copy 2: a local backup on a USB disk or a second NAS, quick to restore from.
• Copy 3: the storage VPS: encrypted, append-only, in a city where you neither live nor work.

A backup kept in one place is a single point of failure with a reassuring name.

How do I send backups from a server to a storage VPS over SSH?

Give every machine its own SSH key, its own account or path on the VPS, and its own repository, then let the backup tool do the rest over SSH. Borg needs Borg installed on the VPS and runs borg serve there; restic can write over plain SFTP with nothing extra on the server, or talk HTTP to rest-server. Separate keys mean one stolen laptop exposes one repository, not all of them.

# On the machine you back up: a key used for backups only
ssh-keygen -t ed25519 -N '' -C 'backup web1' -f ~/.ssh/backup_ed25519
cat ~/.ssh/backup_ed25519.pub

# On the storage VPS, as root: one account per machine, holding that key
mkdir -p /srv/backup
useradd --create-home --home-dir /srv/backup/web1 --shell /bin/sh backup-web1
install -d -m 700 -o backup-web1 -g backup-web1 /srv/backup/web1/.ssh
echo 'ssh-ed25519 AAAA...paste-the-key... backup web1' >> /srv/backup/web1/.ssh/authorized_keys
chown backup-web1:backup-web1 /srv/backup/web1/.ssh/authorized_keys

# Back on the client: a short SSH alias, then restic over SFTP
cat >> ~/.ssh/config <<'EOF'
Host coffer
    HostName 203.0.113.10
    User backup-web1
    IdentityFile ~/.ssh/backup_ed25519
    IdentitiesOnly yes
EOF
restic -r sftp:coffer:/srv/backup/web1/repo init
restic -r sftp:coffer:/srv/backup/web1/repo backup /etc /home /var/www

Why encrypt on the client instead of on the VPS?

Because then the VPS only ever stores ciphertext, and nobody who reaches its disk can read your files. Whoever runs a hypervisor can technically read an unencrypted virtual disk, at any VPS host. We do not open your files, and data you encrypt before it leaves your machine takes the question off the table. KVM gives your server its own kernel, so you can put LUKS on the data disk or run ZFS with native encryption, and the keys never leave you. For backups, encrypt on your own machine before upload (Borg, restic and Kopia all do it), so the server only ever holds ciphertext.

Borg asks for an encryption mode at borg init; its documentation recommends repokey with a strong passphrase and says to keep a copy of the key outside both the repository and the machine being backed up. restic encrypts all the data it stores with AES-256 and authenticates it with Poly1305-AES, with no unencrypted mode. Keep the passphrase and the exported key in a password manager and on paper. Encryption done on the server protects the server; encryption done on your machine protects you.

What does append-only mode protect against?

Append-only stops a compromised client from erasing the backups it made. An attacker who owns a server also owns its backup credentials, and in normal mode those can run borg delete or restic forget --prune before the ransom note appears.

• Borg: add --append-only to the borg serve command forced in authorized_keys. Borg's documentation notes that prune and delete still run in this mode but only tag data as deleted: no space is freed and no compaction happens.
• restic: start rest-server with --append-only, which accepts new backups and refuses to delete or modify existing ones. Plain SFTP has no such mode.

The price is housekeeping: pruning needs a second, unrestricted key, used from a machine the attacker cannot reach. On append-only restic repositories, restic's documentation tells you to write forget policies with --keep-within. The full Borg recipe is in How do I set up a Borg backup server on a VPS?, and the restic choice in Restic: REST server or SFTP for backups to a VPS?.

How do I know my off-site backup will restore?

Restore from it, on a schedule, onto a machine that is not the original. A job that exits with status 0 proves the upload worked, not that your files come back. Spread the checks out so the slow ones run rarely:

How long does a full restore take, and does it fit the traffic quota?

At full line rate a 1 Gbit/s port moves 1 TB in about 2 hours 15 minutes; in practice your own connection and the hard disks set a slower pace. That figure is arithmetic (8,000 gigabits at one gigabit per second), not a measured speed, so time the restore of a real folder before you count on it.

Every plan's monthly traffic quota is more than twice its disk, 4 TB a month on the 1 TB Clay plan for instance, so uploading a full disk and restoring all of it in the same month stays inside the quota. Each server has one IPv4 address and an IPv6 /64 on a 1 Gbit/s port, with a monthly traffic quota of 2 TB plus 2 TB per TB stored: 3 TB for Silt, 4 TB for Clay, 6 TB for Shale, 10 TB for Granite, 18 TB for Bedrock. Past the quota the port runs at 100 Mbit/s until the next period begins; nothing extra is billed.

What does an off-site backup target cost per TB?

According to Coffervale's survey of 2 November 2026, storage VPS plans from hosts that take crypto and ask for no ID document cost a median $4.00 per TB a month, while general-purpose VPS plans from the same hosts cost $223.44 per TB, about 56 times more. Backups belong on disks sized for capacity. Hosted backup storage gives you no server of your own, as the table shows; the trade-off is weighed in Is a storage VPS a cheaper alternative to rsync.net or BorgBase?. Every plan and term is on How much does a storage VPS cost per month?, and the 1 TB plan in detail on Where can I get a VPS with 1 TB of storage?.