A dedicated backup server is one of the most important investments you can make in your infrastructure. Storing backups on the same server as your production data is risky — if the server fails, you lose both your data and your backups. A separate Storage VPS in a different data center region provides geographic redundancy and reliable recovery options.

This guide walks you through setting up a Data Mammoth Storage VPS as a centralized backup server for your infrastructure.

Architecture Overview

The basic backup architecture is:

For best results, place your backup server in a different data center region from your production servers. This ensures your backups survive even if a regional event affects your production infrastructure.

Prerequisites

• A Data Mammoth Storage VPS provisioned and accessible via SSH. See How to Order a Storage VPS.
• One or more production servers to back up.
• SSH key-based authentication configured between your production servers and the backup server.

Step 1 — Prepare the Backup Server

SSH into your Storage VPS and set up the backup infrastructure.

Create a Backup User

Create a dedicated user for backup operations instead of using root:

sudo adduser backups --disabled-password
sudo mkdir -p /home/backups/.ssh
sudo chmod 700 /home/backups/.ssh

Configure SSH Access

Copy the SSH public key from each production server to the backup user's authorized_keys file:

sudo nano /home/backups/.ssh/authorized_keys

Paste each production server's public key on its own line. Then set proper permissions:

sudo chown -R backups:backups /home/backups/.ssh
sudo chmod 600 /home/backups/.ssh/authorized_keys

Create Backup Directories

Organize storage by server:

sudo mkdir -p /backups/server-web-01
sudo mkdir -p /backups/server-db-01
sudo mkdir -p /backups/server-app-01
sudo chown -R backups:backups /backups

Step 2 — Set Up Backups with rsync

rsync is the simplest and most widely used backup tool. It efficiently copies files by only transferring changes since the last backup.

Basic rsync Backup Command

From your production server, run:

rsync -avz --delete \
  -e "ssh -i /root/.ssh/backup_key" \
  /var/www/ \
  [email protected]:/backups/server-web-01/www/

This command:

• -a — Archive mode (preserves permissions, timestamps, symlinks).
• -v — Verbose output.
• -z — Compress data during transfer.
• --delete — Remove files from the backup that were deleted on the source.
• Copies /var/www/ from the production server to the backup server.

Backing Up Multiple Directories

Create a backup script on your production server:

#!/bin/bash
BACKUP_HOST="[email protected]"
BACKUP_DIR="/backups/server-web-01"
SSH_KEY="/root/.ssh/backup_key"
Back up web files
rsync -avz --delete -e "ssh -i $SSH_KEY" /var/www/ $BACKUP_HOST:$BACKUP_DIR/www/
Back up configuration
rsync -avz --delete -e "ssh -i $SSH_KEY" /etc/nginx/ $BACKUP_HOST:$BACKUP_DIR/nginx-config/
rsync -avz --delete -e "ssh -i $SSH_KEY" /etc/letsencrypt/ $BACKUP_HOST:$BACKUP_DIR/ssl-certs/
Back up database
mysqldump --all-databases | gzip | ssh -i $SSH_KEY $BACKUP_HOST "cat > $BACKUP_DIR/db/mysql-all-$(date +%Y%m%d).sql.gz"
echo "Backup completed: $(date)"

Save this as /root/backup.sh and make it executable: chmod +x /root/backup.sh.

Automate with Cron

Schedule the backup to run automatically:

crontab -e

Add a daily backup at 2 AM:

0 2   * /root/backup.sh >> /var/log/backup.log 2>&1

Step 3 — Set Up Backups with BorgBackup (Advanced)

BorgBackup (Borg) is a more sophisticated backup tool that provides deduplication, compression, and encryption. It is more storage-efficient than rsync because it only stores unique data blocks across all backups.

Install BorgBackup

On both the production server and the backup server:

sudo apt install borgbackup -y

Initialize a Borg Repository

From your production server, initialize a repository on the backup server:

borg init --encryption=repokey [email protected]:/backups/server-web-01/borg-repo

You will be asked to set an encryption passphrase. Save this passphrase securely — without it, your backups cannot be decrypted.

Create a Backup

borg create --stats --progress \
  [email protected]:/backups/server-web-01/borg-repo::backup-{now:%Y-%m-%d} \
  /var/www \
  /etc/nginx \
  /etc/letsencrypt

This creates a backup archive named with the current date.

Set Up Retention Policies

Borg can automatically prune old backups based on retention rules:

borg prune --stats \
  [email protected]:/backups/server-web-01/borg-repo \
  --keep-daily=7 \
  --keep-weekly=4 \
  --keep-monthly=6

This keeps the last 7 daily, 4 weekly, and 6 monthly backups.

Automate with a Script

Create a comprehensive backup script:

#!/bin/bash
export BORG_REPO="[email protected]:/backups/server-web-01/borg-repo"
export BORG_PASSPHRASE="your-secure-passphrase"
Dump database before backup
mysqldump --all-databases > /tmp/mysql-dump.sql
Create backup
borg create --stats \
  $BORG_REPO::backup-{now:%Y-%m-%d-%H%M} \
  /var/www \
  /etc/nginx \
  /etc/letsencrypt \
  /tmp/mysql-dump.sql
Prune old backups
borg prune --stats $BORG_REPO \
  --keep-daily=7 \
  --keep-weekly=4 \
  --keep-monthly=6
Clean up
rm /tmp/mysql-dump.sql
echo "Borg backup completed: $(date)"

Schedule this with cron, just like the rsync method.

Step 4 — Verify Your Backups

A backup you have never tested is a backup you cannot trust. Regularly verify your backups:

For rsync

• SSH into the backup server and verify file presence: ls -la /backups/server-web-01/
• Check file sizes and dates for reasonableness.
• Periodically restore files to a test server and verify they work.

For BorgBackup

• List archives: borg list [email protected]:/backups/server-web-01/borg-repo
• Check archive contents: borg list [email protected]:/backups/server-web-01/borg-repo::backup-2026-03-17
• Verify integrity: borg check [email protected]:/backups/server-web-01/borg-repo
• Test restoration to a temporary directory.

Step 5 — Monitor Backup Success

Log Monitoring

Check backup logs regularly for errors:

tail -50 /var/log/backup.log

Notification on Failure

Add error checking to your backup script and send notifications on failure. A simple approach:

if [ $? -ne 0 ]; then
  echo "Backup FAILED on $(hostname) at $(date)" | mail -s "Backup Failure Alert" [email protected]
fi

Security Best Practices

• Encrypt your backups — Use BorgBackup's built-in encryption or encrypt data before transfer.
• Restrict SSH access — Only allow the specific backup SSH keys to connect to the backup server.
• Configure the firewall — Only allow SSH connections from your production server IPs. See How to Set Up Cloud Firewall Rules.
• Monitor access — Review backup server logs for unauthorized access attempts.
• Protect the passphrase — Store encryption passphrases in a secure password manager, separate from the backup server itself.

What to Do Next

• How to Order a Storage VPS — Order a dedicated backup server.
• How to Create and Restore VPS Snapshots — Complement server-level backups with snapshots.
• How to Set Up Cloud Firewall Rules — Secure your backup server.
• Storage VPS vs Object Storage — Compare backup storage options.