Install and configure borgmatic

Introduction

This tutorial will give you a short introduction into borgmatic and how to create an full system backup of your server onto your Hetzner Storage Box.

Borgmatic is a simple tool which simplifies the use of BorgBackup and extends it with some more features.

The official documentation is available at the borgmatic website.

Prerequisites

• A linux server you want to backup
• A StorageBox with enough free space and set up SSH-Keys.

A tutorial on how to setup SSH-Keys for your Storage Box can be found in the Hetzner Docs.

Step 1 - Install and configure borgmatic

In this step we will cover how to install and configure borgmatic.

Step 1.1 Install BorgBackup and borgmatic

Borgmatic does not automatically include BorgBackup, so we have to install both packages manually:

apt install borgbackup borgmatic

Step 1.2 - Configuration of borgmatic

An example configuration can be generated with

generate-borgmatic-config

This will generate a configuration with example values at /etc/borgmatic/conf.yml.

A full list of available configuration parameters can be found in the official configuration reference.

For this tutorial you can use the following configuration:

location:
    # Here you can specify a list of Storage Boxes as backup target.
    repositories:
        - u123456@u123456.your-storagebox.de:backups

    # A list of all directoy which should be included within the backup.
    # As we want to create a full system backup "/" is sufficient.
    source_directories:
        - /

    # Exclude the default mount directory and any directories which are created at runtime.
    exclude_patterns:
        - /dev
        - /proc
        - /sys
        - /var/run
        - /run
        - /mnt
        - /tmp

storage:
    # Here you can specify the password which is used to encrypt your backups. This is _not_ your Storage Box password.
    # Do not lose this. Otherwise you are not able to restore your backup later.
    encryption_passphrase: "<SUPER SECRET PASSWORD>"

    # As BorgBackup is running on port 23 on the Storage Boxes, we have to overwrite the default ssh command in order to specify a port.
    ssh_command: "ssh -p 23"

# Here you can specify how many backups should be kept at minumim for the specified time frame.
retention:
    keep_daily: 7
    keep_weekly: 4
    keep_monthly: 6
    keep_yearly: 1

Step 1.3 - Initializing and creating our first backup

Before we can create our first backup, we have to initialize our backup repository first.

borgmatic init --encryption repokey --verbosity 1

After the successful initialization we can create our first backup.

borgmatic --verbosity 1

The first backup may take a while, depending on the size of your Server. Future backups will be faster as they are only incremental.

Step 2 - Automatization

Use systemctl status borgmatic.timer borgmatic.service to check if the service and the timer already exist.

• If you get an error like Unit borgmatic.XXX could not be found, you can follow the instructions below.
• If the units are found and you can see their status, you can skip this step.

For the automatization we will use a systemd unit and timer. Copy the following part, which starts the backup, to /etc/systemd/system/borgmatic.service:

[Unit]
Description=Borgmatic system backup
Requires=network.target
After=network.target

[Service]
Type=oneshot
Nice=10
IOSchedulingClass=best-effort
IOSchedulingPriority=6
ProtectSystem=full
ExecStart=/usr/bin/borgmatic --verbosity -1 --syslog-verbosity 1

The following part is responsible for the regular start of the backup. Copy it to /etc/systemd/system/borgmatic.timer.

[Unit]
Description=Daily backup timer

[Timer]
OnCalendar=*-*-* 16:30:00
Persistent=true

[Install]
WantedBy=timers.target

Now we just have to enable the timer:

systemctl enable --now borgmatic.timer

The timer will start a backup, everyday at 16:30.

Conclusion

With Borgmatic we have a simple, yet powerful tool which allows us to create backups of our systems. We have configured it and set up automatic backups in order to protect against data loss.