# How do I use a storage VPS for off-site backups?

> How to use a VPS for off-site backups: a backup VPS over SSH with Borg or restic, 3-2-1, append-only, 1 TB from $1.66/month, crypto, no ID.

- URL: https://coffervale.com/backup-vps/
- Last updated: 2026-11-02
- Publisher: Coffervale (https://coffervale.com)

Point your servers and laptops at a storage VPS over SSH, encrypt before anything leaves them, make the copy append-only, then prove it restores. Here is the whole setup, and what one VPS can never do for you.

**Quick answer — How do I use a VPS for off-site backups?**

To use a VPS for off-site backups, rent a storage VPS in another city, give each machine its own SSH key and repository, and run Borg or restic so data is encrypted before it leaves you. At **Coffervale**, 1 TB costs $1.66 a month on 12 months (2 November 2026). Keep it as one of three copies.

## A backup VPS in five lines

| Attribute | Value |
| --- | --- |
| Where it sits | In another city, under another account than the data it protects |
| How data gets there | SSH: Borg (`borg serve`), restic (SFTP or rest-server), or rsync |
| Who holds the key | You: encrypt on the client, so the VPS stores ciphertext only |
| What stops a hacked client | Append-only access: new backups allowed, deletions refused |
| How you know it works | Scheduled checks plus a real restore to another machine |

## What does a backup VPS give you that RAID or a snapshot does not?

**A backup VPS holds a separate, versioned copy of your data in another building, reached with its own credentials.** That is the one property the usual stand-ins lack. Disk redundancy keeps a server running through a failed drive; it does not undo a deletion, ransomware or a lost account, so it is not a backup. A snapshot sits on the same disks as the server it captures, so it can roll back a mistake but it is not an off-site copy.

In searches, "backup VPS" means two things: backing a VPS up elsewhere, and using a VPS as the place backups land. It is one job seen from either end: a production server pushes Borg or restic archives to a storage VPS exactly as a laptop does.

### Which copy survives what?

| Event | RAID in the same server | Snapshot on the same host | Append-only backup VPS in another city |
| --- | --- | --- | --- |
| One drive dies | Survives | Survives if the array does | Survives |
| You delete a folder by mistake | Deletion is copied at once | Roll back to the snapshot | Restore from an older archive |
| Ransomware encrypts the server | Encrypted files are copied at once | Lost if the attacker also holds the panel login | Older archives stay: the client key cannot delete them |
| Fire or flood at the datacenter | Lost | Lost | Survives |
| The hosting account is closed | Lost | Lost | Survives if it runs under another account |

## Why is one storage VPS not a 3-2-1 backup?

**Because 3-2-1 counts copies, media and places, and one VPS is one copy in one place.** The rule, as US-CERT's paper *Data Backup Options* sets it out, is three copies of every important file, on two different media types, with one copy stored off-site. One storage VPS is one copy in one place. The 3-2-1 rule asks for three copies, on two kinds of media, with one of them off-site: a storage VPS fits as that off-site copy, next to two you keep yourself.

A layout that satisfies it for a home lab or a small team:

- **Copy 1:** the live data on your laptop, server or NAS.
- **Copy 2:** a local backup on a USB disk or a second NAS, quick to restore from.
- **Copy 3:** the storage VPS: encrypted, append-only, in a city where you neither live nor work.

A backup kept in one place is a single point of failure with a reassuring name.

## How do I send backups from a server to a storage VPS over SSH?

**Give every machine its own SSH key, its own account or path on the VPS, and its own repository, then let the backup tool do the rest over SSH.** Borg needs Borg installed on the VPS and runs `borg serve` there; restic can write over plain SFTP with nothing extra on the server, or talk HTTP to rest-server. Separate keys mean one stolen laptop exposes one repository, not all of them.

*One key, one account, one repository per machine (restic over SFTP)*

```bash
# On the machine you back up: a key used for backups only
ssh-keygen -t ed25519 -N '' -C 'backup web1' -f ~/.ssh/backup_ed25519
cat ~/.ssh/backup_ed25519.pub

# On the storage VPS, as root: one account per machine, holding that key
mkdir -p /srv/backup
useradd --create-home --home-dir /srv/backup/web1 --shell /bin/sh backup-web1
install -d -m 700 -o backup-web1 -g backup-web1 /srv/backup/web1/.ssh
echo 'ssh-ed25519 AAAA...paste-the-key... backup web1' >> /srv/backup/web1/.ssh/authorized_keys
chown backup-web1:backup-web1 /srv/backup/web1/.ssh/authorized_keys

# Back on the client: a short SSH alias, then restic over SFTP
cat >> ~/.ssh/config <<'EOF'
Host coffer
    HostName 203.0.113.10
    User backup-web1
    IdentityFile ~/.ssh/backup_ed25519
    IdentitiesOnly yes
EOF
restic -r sftp:coffer:/srv/backup/web1/repo init
restic -r sftp:coffer:/srv/backup/web1/repo backup /etc /home /var/www
```

### Which tool should push the backups?

| Tool | Transport to the VPS | Encrypts before upload | Stores only changed chunks | Append-only option |
| --- | --- | --- | --- | --- |
| Borg 1.4 | SSH, `borg serve` on the VPS | Yes (`repokey`, `keyfile`) | Yes | Yes, per SSH key: `borg serve --append-only` |
| restic 0.19 | SFTP, or HTTP(S) to rest-server | Yes, always on | Yes | Only with rest-server `--append-only` |
| rsync | SSH | No: files land as they are | No; `--link-dest` hard-links unchanged files | No |

Versions: Borg 1.4.5 and restic 0.19.1 were the latest stable releases on 2 November 2026. Borg 2 is still in beta and cannot read Borg 1.x repositories.

## Why encrypt on the client instead of on the VPS?

**Because then the VPS only ever stores ciphertext, and nobody who reaches its disk can read your files.** Whoever runs a hypervisor can technically read an unencrypted virtual disk, at any VPS host. We do not open your files, and data you encrypt before it leaves your machine takes the question off the table. KVM gives your server its own kernel, so you can put LUKS on the data disk or run ZFS with native encryption, and the keys never leave you. For backups, encrypt on your own machine before upload (Borg, restic and Kopia all do it), so the server only ever holds ciphertext.

Borg asks for an encryption mode at `borg init`; its documentation recommends `repokey` with a strong passphrase and says to keep a copy of the key outside both the repository and the machine being backed up. restic encrypts all the data it stores with AES-256 and authenticates it with Poly1305-AES, with no unencrypted mode. Keep the passphrase and the exported key in a password manager and on paper. Encryption done on the server protects the server; encryption done on your machine protects you.

## What does append-only mode protect against?

**Append-only stops a compromised client from erasing the backups it made.** An attacker who owns a server also owns its backup credentials, and in normal mode those can run `borg delete` or `restic forget --prune` before the ransom note appears.

- **Borg:** add `--append-only` to the `borg serve` command forced in `authorized_keys`. Borg's documentation notes that prune and delete still run in this mode but only tag data as deleted: no space is freed and no compaction happens.
- **restic:** start rest-server with `--append-only`, which accepts new backups and refuses to delete or modify existing ones. Plain SFTP has no such mode.

The price is housekeeping: pruning needs a second, unrestricted key, used from a machine the attacker cannot reach. On append-only restic repositories, restic's documentation tells you to write `forget` policies with `--keep-within`. The full Borg recipe is in [How do I set up a Borg backup server on a VPS?](https://coffervale.com/borg-backup-server-on-a-vps/ "Borg server setup on a storage VPS, step by step"), and the restic choice in [Restic: REST server or SFTP for backups to a VPS?](https://coffervale.com/restic-rest-server-vs-sftp/ "restic rest-server against SFTP on a storage VPS").

## How do I know my off-site backup will restore?

**Restore from it, on a schedule, onto a machine that is not the original.** A job that exits with status 0 proves the upload worked, not that your files come back. Spread the checks out so the slow ones run rarely:

### A restore-testing routine

| How often | What to run | What it proves |
| --- | --- | --- |
| After every run | Read the exit status and log of `borg create` or `restic backup` | The job ran to the end |
| Weekly | `borg check` or `restic check` | Repository structure and indexes are sound |
| Monthly | `restic check --read-data-subset=10%`, or `borg check --verify-data` (reads every chunk, slow on HDD) | Stored data decrypts and matches its checksums |
| Every quarter | Extract a real folder onto a spare machine and open the files | You can get the data back with the key and passphrase you kept |

## How long does a full restore take, and does it fit the traffic quota?

**At full line rate a 1 Gbit/s port moves 1 TB in about 2 hours 15 minutes; in practice your own connection and the hard disks set a slower pace.** That figure is arithmetic (8,000 gigabits at one gigabit per second), not a measured speed, so time the restore of a real folder before you count on it.

Every plan's monthly traffic quota is more than twice its disk, 4 TB a month on the 1 TB Clay plan for instance, so uploading a full disk and restoring all of it in the same month stays inside the quota. Each server has one IPv4 address and an IPv6 /64 on a 1 Gbit/s port, with a monthly traffic quota of 2 TB plus 2 TB per TB stored: 3 TB for Silt, 4 TB for Clay, 6 TB for Shale, 10 TB for Granite, 18 TB for Bedrock. Past the quota the port runs at 100 Mbit/s until the next period begins; nothing extra is billed.

## What does an off-site backup target cost per TB?

**According to Coffervale's survey of 2 November 2026, storage VPS plans from hosts that take crypto and ask for no ID document cost a median $4.00 per TB a month, while general-purpose VPS plans from the same hosts cost $223.44 per TB, about 56 times more.** Backups belong on disks sized for capacity. Hosted backup storage gives you no server of your own, as the table shows; the trade-off is weighed in [Is a storage VPS a cheaper alternative to rsync.net or BorgBase?](https://coffervale.com/rsync-net-alternative/ "Storage VPS against rsync.net and BorgBase"). Every plan and term is on [How much does a storage VPS cost per month?](https://coffervale.com/pricing/ "Coffervale storage VPS prices and terms"), and the 1 TB plan in detail on [Where can I get a VPS with 1 TB of storage?](https://coffervale.com/1tb-vps/ "1 TB storage VPS: specs and price").

| Option | What it is | Price per TB a month | Root and your own software |
| --- | --- | --- | --- |
| Coffervale Clay (1 TB) | Storage VPS, HDD | $1.66 on 12 months | Yes |
| Hetzner Storage Box BX11 | Network storage over SFTP and Samba | $3.58 | No |
| Backblaze B2 | Object storage | $6.95 | No |
| BorgBase Medium | Hosted Borg and restic repositories | $9.17 | No |
| rsync.net | Backup storage over SSH | $15.00 | No |

*Prices checked on November 2, 2026.*

Prices as published on each provider's page on 2 November 2026; euro prices converted at 1 EUR = 1.1172 USD (ECB, 30 October 2026). Hetzner prices exclude VAT.

## Questions about backup VPS

### Can I back up a VPS to another VPS?

Yes. Install Borg or restic on the production server, point it at a storage VPS in another city over SSH, and run it from cron or a systemd timer. Use a different account, ideally at a different provider, so one account problem cannot take both copies.

### Should I use Borg or restic for a backup VPS?

Both encrypt on the client and store only changed chunks. Borg needs Borg on the VPS and gives append-only access per SSH key; restic writes over plain SFTP, or to rest-server when you want append-only. Pick the one whose restore commands you are comfortable typing under stress.

### Does Coffervale back up my backup VPS?

No. We take no backup of your server and keep no copy of your data anywhere else, so what sits on a Coffervale storage VPS should be one of your copies, never the only one. That is exactly why the VPS should hold your third copy, not your only one.

### How much space do backups need?

Start from the size of the data you protect, then add room for history. Deduplicating tools store unchanged chunks once, so daily archives of mostly static files grow slowly; after a month, `borg info` or `restic stats` shows the real figure. To grow, order a larger plan and copy your data across with rsync or zfs send; resizing a running server in place is not offered at launch.

### Can I pay for a backup VPS without showing ID?

Yes. No KYC: no ID document, no selfie, no card and no phone number is asked at signup. You top up a balance with BTC, USDT, USDC, ETH, SOL, LTC, XMR, from $1, and order from it.

## Sources

1. [Data Backup Options (P. Ruggiero, M. A. Heckathorn, 2012): the 3-2-1 rule](https://www.cisa.gov/sites/default/files/publications/data_backup_options.pdf) — US-CERT / CISA (read 2026-11-02)
2. [Borg 1.4.5 documentation: Additional notes, append-only mode](https://borgbackup.readthedocs.io/en/stable/usage/notes.html) — BorgBackup project (read 2026-11-02)
3. [Borg 1.4.5 documentation: borg init, encryption modes and key backup](https://borgbackup.readthedocs.io/en/stable/usage/init.html) — BorgBackup project (read 2026-11-02)
4. [Borg 2.0 (preliminary information)](https://www.borgbackup.org/releases/borg-2.0.html) — BorgBackup project (read 2026-11-02)
5. [restic documentation: Preparing a new repository (SFTP, REST server)](https://restic.readthedocs.io/en/stable/030_preparing_a_new_repo.html) — restic project (read 2026-11-02)
6. [restic documentation: Removing backup snapshots (append-only and --keep-within)](https://restic.readthedocs.io/en/stable/060_forget.html) — restic project (read 2026-11-02)
7. [restic documentation: Checking integrity and consistency](https://restic.readthedocs.io/en/stable/045_working_with_repos.html) — restic project (read 2026-11-02)
8. [restic documentation: References, repository encryption](https://restic.readthedocs.io/en/stable/100_references.html) — restic project (read 2026-11-02)
9. [Rest Server README: append-only mode](https://github.com/restic/rest-server) — restic project (read 2026-11-02)
10. [rsync(1) manual page: --link-dest, transport encryption](https://download.samba.org/pub/rsync/rsync.1) — rsync project (Samba) (read 2026-11-02)
11. [Storage Box plans (BX11 to BX41)](https://www.hetzner.com/storage/storage-box/) — Hetzner Online (read 2026-11-02)
12. [B2 Cloud Storage pricing](https://www.backblaze.com/cloud-storage/pricing) — Backblaze (read 2026-11-02)
13. [Plans and pricing](https://www.borgbase.com/) — BorgBase (read 2026-11-02)
14. [Cloud storage pricing](https://www.rsync.net/pricing.html) — rsync.net (read 2026-11-02)

---

Coffervale: Coffervale sells storage VPS in Europe: KVM servers with 500 GB to 8 TB of HDD storage for off-site backups, Nextcloud, Seafile, Syncthing and archives, paid in crypto with no ID at signup. The servers run in Amsterdam, Bucharest and Chișinău, and the operator is DomaineGoat LLC, a company registered in Panama. On the 12-month term, every plan is priced at least 25% a month under a named comparable storage VPS, picked from 10 no-KYC crypto hosts whose prices were read on 2 November 2026.