Can the storage provider read my backups?

Not with the setup below. Borg encrypts on your server before anything is sent, with a key that is protected by your passphrase. The storage box only ever holds encrypted chunks. The flip side is that nobody — including us — can recover the backups if you lose both the passphrase and the exported key.

Does it work with Borg 2?

Use a Borg 1.x client (1.2 or later is ideal). The storage side runs Borg 1.2, and Borg 2 changed the repository format, so a Borg 2 client cannot use a Borg 1 repository.

How much space and transfer will it use?

The first backup sends and stores everything, after compression and deduplication. After that each run only sends what changed, which is usually a small fraction. Your storage box dashboard shows space used and transfer this month; the shell's quota command shows the same from the server side.

Why run borg compact?

Since Borg 1.2, prune only marks old archives as deleted; compact is what actually frees the space. Without it the repository keeps growing even though you are pruning.

How to Back Up a Linux Server with Borg

1. Install Borg and Make a Key

On the server you want to back up (Debian or Ubuntu shown):

sudo apt install borgbackup
borg --version          # 1.2 or later

# A key used only for backups, with no passphrase so the timer can use it
sudo ssh-keygen -t ed25519 -f /root/.ssh/storagebox -N "" -C "borg@$(hostname)"
sudo cat /root/.ssh/storagebox.pub

Add the printed public key to your storage box in the dashboard (Storage → your box → SSH keys). Then give the box a short name in root's SSH config so every command below stays readable — replace the username with your box's:

# /root/.ssh/config
Host storagebox
    HostName bend.storage.virteche.com
    Port 23
    User sb123456
    IdentityFile /root/.ssh/storagebox

Connect once by hand and compare the host key fingerprint with the one shown in your dashboard before answering yes:

sudo ssh storagebox quota

2. Create the Repository

The passphrase goes in a file only root can read, so the nightly script can use it. Make it first, then create the repository with it, so the two are guaranteed to match:

sudo install -m 600 /dev/null /root/.borg-passphrase
openssl rand -base64 32 | sudo tee /root/.borg-passphrase >/dev/null
sudo BORG_PASSCOMMAND="cat /root/.borg-passphrase"     borg init --encryption=repokey-blake2 ssh://storagebox/./$(hostname)

Copy the passphrase (sudo cat /root/.borg-passphrase) into your password manager: it must be stored somewhere other than this server. Then export the key — with repokey it lives inside the repository, and the export is your copy if the repository's copy is ever damaged:

sudo borg key export ssh://storagebox/./$(hostname) /root/borg-key-backup.txt
# copy that file off this server, next to the passphrase

3. A Backup Script

Save this as /usr/local/sbin/backup-to-storagebox (for example with sudo nano /usr/local/sbin/backup-to-storagebox). Adjust the paths to what matters on your server — configuration, application data, and database dumps rather than live database files:

#!/bin/sh
# /usr/local/sbin/backup-to-storagebox
set -eu
export BORG_REPO="ssh://storagebox/./$(hostname)"
export BORG_PASSCOMMAND="cat /root/.borg-passphrase"

borg create --stats --compression zstd,6 --exclude-caches \
    --exclude '/home/*/.cache' \
    ::'{hostname}-{now:%Y-%m-%dT%H:%M}' \
    /etc /home /root /var/www /var/backups

borg prune --list --keep-daily 7 --keep-weekly 4 --keep-monthly 6
borg compact

sudo chmod 700 /usr/local/sbin/backup-to-storagebox
sudo /usr/local/sbin/backup-to-storagebox      # the first run sends everything

4. Run It Every Night

# /etc/systemd/system/borg-backup.service
[Unit]
Description=Borg backup to storage box
Wants=network-online.target
After=network-online.target

[Service]
Type=oneshot
ExecStart=/usr/local/sbin/backup-to-storagebox

# /etc/systemd/system/borg-backup.timer
[Unit]
Description=Nightly Borg backup

[Timer]
OnCalendar=*-*-* 03:15
RandomizedDelaySec=30m
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable --now borg-backup.timer
systemctl list-timers borg-backup.timer
journalctl -u borg-backup.service      # what the last run did

5. Prove You Can Restore

A backup you have never restored from is a hope, not a backup. List what is there and pull a file back:

sudo -i
export BORG_REPO="ssh://storagebox/./$(hostname)" BORG_PASSCOMMAND="cat /root/.borg-passphrase"
borg list
cd /tmp && borg extract ::ARCHIVE-NAME etc/hostname
cat /tmp/etc/hostname

Do this again from a different machine, using only the passphrase and the exported key file — that is the situation you are really preparing for. borg check verifies the repository's integrity; run it occasionally, not on every backup.

The 3-2-1 Rule

Your server plus this Borg repository is already two copies in two places. For data you truly cannot lose, the usual rule is three copies, on two kinds of storage, one of them off-site. See storage box vs object storage for how the options compare.