LibrePortal
Sponsor
Install

The Backup Server

A second, small machine that keeps an encrypted copy of your backups somewhere else, where your installs can't change or delete them. What it is, and a guide for each step.

On this page
  1. Why a second machine
  2. How it works
  3. What it looks after for you
  4. What it doesn't do
  5. Where to start

Backups kept on the same machine protect you from a bad update. They don't protect you from a dead disk, a burglary or a house fire, because the backups go down with the server.

The Backup Server fixes that. It's a small program for a second machine, such as a cheap VPS or a spare computer in another building. Its only job is to keep your backups safe.

Install itWhat you need, the one command, and the short setup wizard. Connect an installPair a LibrePortal with a one-time code and see its first backup. Everyday useSchedule, retention, alerts, getting data back, and updates. Keeping it safeThe recovery file, the master password and what root on the box can do. TroubleshootingCalm fixes for the problems people meet most.

Why a second machine#

If a backup lives next to the thing it protects, anything that hurts one hurts both: a failed disk, a fire, a flood, a thief, ransomware. A copy on another machine, in another place, is the one that's still there afterwards.

The Backup Server is built so that the machine being backed up can't spoil its own history. Even if someone broke into your install, they would find nothing there that can wipe your old backups.

How it works#

How the Backup Server gets your backups Each night the Backup Server, inside its own VPN, reaches into your LibrePortal install through a read-only door and pulls copies of the apps and databases. It stores them in encrypted repositories, locked by a vault that opens with your master password or the machine key. You reach the Backup Server's panel from your phone or laptop over the same VPN. YOUR LIBREPORTAL INSTALL Apps and databases tidy copies made on request One read-only door opens for one key, one address WireGuard VPN Pulled each night over SSH BACKUP SERVER Encrypted repositories one per install, each with its own password Vault with two keys your master password, and a machine key You phone or laptop, on the same VPN the panel
How the Backup Server gets your backups Each night the Backup Server, inside its own VPN, reaches into your LibrePortal install through a read-only door and pulls copies of the apps and databases. It stores them in encrypted repositories, locked by a vault that opens with your master password or the machine key. You reach the Backup Server's panel from your phone or laptop over the same VPN. YOUR LIBREPORTAL INSTALL Apps and databases tidy copies made on request One read-only door opens for one key, one address WIREGUARD VPN Pulled each night over SSH BACKUP SERVER Encrypted repositories one per install, each with its own password Vault with two keys your master password, and a machine key the panel You phone or laptop, on the same VPN
The Backup Server reaches into your install each night. Your install can't reach into it. You look after it from a device on its VPN.

Four ideas hold the whole thing together.

It pulls, it isn't pushed to. Each night the Backup Server reaches into your install over SSH, using its own key. It asks the install to prepare tidy copies of every app's files and databases, and then it fetches them. Your install never holds a login that can write to or delete from the Backup Server. All it has is one read-only door, and that door only opens for the Backup Server's address.

It's private. By default the Backup Server can only be reached over its own WireGuard VPN, so its panel isn't on the open internet. You add your phone and computer to that VPN when you set it up.

It's encrypted. The backups are stored in restic repositories, one for each install, each with its own random password. Nothing is shared between installs.

It runs without you. The passwords live in an encrypted vault with two keys. Your master password opens it when you want to look at things or change them. A machine key that only root on the Backup Server can read opens it for the nightly backups, so they carry on after a reboot with nobody typing anything.

Why the Backup Server pulls

If your install pushed its backups out, it would need a password to the place they're stored, and anyone who got into the install would have that password. By having the Backup Server fetch the backups with its own key, the install only has to allow one read-only door.

What it looks after for you#

  • A schedule. Every source is backed up every night at 02:00, plus a moment of its own within the following hour so that sources take turns. A failed backup is tried twice more.
  • Tidying. It keeps the recent snapshots your install asked for and prunes the rest. It refuses to prune when a backup suddenly looks much smaller than usual, because that can mean something went wrong on the install.
  • Telling you. It sends alerts to your phone through ntfy when something is wrong, and one short summary a day.
  • Updating itself. Every day at 12:30 it installs a newer signed release, if there is one and no backup is running.

What it doesn't do#

It isn't a second copy of your apps that you can open and use. It holds backups, and getting data back means a restore from your install.

It doesn't replace your install's own backups on the same machine. Those are quicker to restore. The Backup Server is the copy for the day that the machine itself is gone.

Where to start#

New here? Read Install it, then Connect an install. When it's running, the Everyday use page is the one to come back to, and Keeping it safe is worth reading once, before you need it.

Next steps

BackupsEncrypted nightly backups, and getting an app or a whole server back.Connect an installPair an install with your Backup Server using a one-time code.Everyday useThe schedule, how long backups are kept, and getting data back.