IT-Ops Field Notes

How to Set Up Automated Offsite Backups with Restic or Borg (2026)

Published

Search intent

Someone searching this wants a concrete, scriptable way to get encrypted backups off their local network automatically — not a general explainer of “what is a 3-2-1 strategy,” but working commands and a schedule they can adapt.

Restic vs Borg: pick one in 30 seconds

Both are open-source, encrypted, deduplicating backup tools that work well from a cron job or systemd timer. The practical differences that actually decide which to use:

  • Restic (current version 0.19.1, released July 2026) backs up directly to a wide range of remote targets — S3-compatible object storage (Backblaze B2, AWS S3, Wasabi, etc.), SFTP, REST servers, and more — without needing special software on the remote end. This makes it the simpler choice if your offsite target is object storage.
  • Borg (current stable series 1.4, at 1.4.5 as of July 2026) backs up over SSH to a remote that’s either a plain server with the borg binary installed, or a purpose-built Borg host like BorgBase or rsync.net. Borg’s deduplication and compression are excellent and slightly more mature than Restic’s, but it’s less flexible about backup targets — no native S3/object-storage support.

Recommendation: if you want to back up to cheap object storage (Backblaze B2, Wasabi), use Restic. If you want to back up over SSH to a dedicated backup host (BorgBase, rsync.net, or your own remote server), use Borg. Both are good enough that this is the deciding factor, not a quality gap.

Choosing an offsite target

  • Backblaze B2: $6/TB/month for storage (roughly $0.006/GB/month), with egress free up to 3x your average monthly storage and $0.01/GB beyond that — a strong fit if restores are occasional, not routine. Works with Restic natively via its S3-compatible API.
  • rsync.net: 1.5 cents/GB/month for accounts under 10TB — the tier almost every homelab or small-office user falls into, and note there’s an 800GB minimum order — dropping to 1.25 cents/GB at 10TB+ and 0.75 cents/GB at 100TB+. Higher per-GB than B2 at this scale, but the account is plain SSH/rsync storage you can point Borg or Restic at directly, with no egress fees at all — a common pick for Borg specifically since rsync.net has documented Borg support and even ships the borg binary server-side.
  • BorgBase: a purpose-built Borg/Restic hosting service; free tier is 10GB across up to 2 repos, then paid tiers around $24/year for 250GB, $90/year for 1TB (annual pricing) — the simplest on-ramp if you don’t want to manage a remote server yourself.

Any of these work; the right one depends on whether you want raw per-GB cost (rsync.net at scale), a generous free tier to start (BorgBase), or the cheapest sustained storage cost with S3-style tooling (Backblaze B2).

Setup 1: Restic to Backblaze B2

Step 1 — Create a B2 bucket and application key in the Backblaze dashboard. Note the keyID, applicationKey, and bucket name.

Step 2 — Install Restic (Debian/Ubuntu):

sudo apt install restic

(Or grab the latest binary release directly from the restic GitHub releases page if your distro’s package is outdated — restic ships as a single static binary.)

Step 3 — Initialize the repository:

export B2_ACCOUNT_ID="<keyID>"
export B2_ACCOUNT_KEY="<applicationKey>"
export RESTIC_REPOSITORY="b2:your-bucket-name:/backups"
export RESTIC_PASSWORD="<a strong, separately-stored passphrase>"

restic init

Store RESTIC_PASSWORD somewhere durable and separate from the backup target itself — losing it makes every snapshot permanently unreadable, since Restic’s encryption has no recovery backdoor by design.

Step 4 — Run a backup:

restic backup /data /etc /home --exclude-caches

Step 5 — Automate it with a systemd timer (preferred over cron for logging and dependency handling). Create /etc/systemd/system/restic-backup.service:

[Unit]
Description=Restic backup to B2

[Service]
Type=oneshot
EnvironmentFile=/etc/restic/env
ExecStart=/usr/bin/restic backup /data /etc /home --exclude-caches
ExecStartPost=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Put the export lines from Step 3 (without the word export, as plain KEY=value lines) into /etc/restic/env and lock it down with chmod 600. Then a timer unit /etc/systemd/system/restic-backup.timer:

[Unit]
Description=Daily restic backup

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

Enable with sudo systemctl enable --now restic-backup.timer.

Setup 2: Borg to a remote host (BorgBase or rsync.net)

Step 1 — Get a repo path from BorgBase (or an SSH-accessible path on rsync.net/your own server) — you’ll get something like user@host:repo.

Step 2 — Install Borg:

sudo apt install borgbackup

Step 3 — Initialize the repository with encryption:

borg init --encryption=repokey-blake2 user@host:repo

Borg will prompt for a passphrase — store it durably, same warning as Restic: no passphrase, no recoverable data.

Step 4 — Run a backup:

export BORG_REPO=user@host:repo
export BORG_PASSPHRASE="<your passphrase>"

borg create --stats --compression zstd '::{now:%Y-%m-%d}' /data /etc /home

Step 5 — Prune old backups and automate. A simple wrapper script /usr/local/bin/borg-backup.sh:

#!/bin/bash
set -e
export BORG_REPO=user@host:repo
export BORG_PASSPHRASE="<your passphrase>"

borg create --stats --compression zstd '::{now:%Y-%m-%d}' /data /etc /home
borg prune --keep-daily 7 --keep-weekly 4 --keep-monthly 6

Schedule it the same way as the Restic example — a systemd timer, or a cron entry (0 2 * * * /usr/local/bin/borg-backup.sh) if you’d rather keep it simple than add two more unit files.

Verify restores actually work

A backup you haven’t test-restored is a hope, not a backup. For Restic: restic restore latest --target /tmp/restore-test. For Borg: borg extract ::2026-07-30 (mount a specific archive to a scratch directory). Do this at least once right after setup, and periodically afterward — the failure mode that actually hurts is discovering a broken passphrase or corrupted repo during an actual emergency restore.

Bottom line

Restic for S3-style targets like Backblaze B2, Borg for SSH-based targets like BorgBase or rsync.net — both are free, both are encrypted by default, and both automate cleanly with a systemd timer or cron job. The setup cost is under an hour; the payoff is a backup that survives your house or office burning down, which a NAS snapshot alone does not.