Setting Up Borgmatic for Automated Encrypted Backups

What Is Borg?

BorgBackup (Borg) is a deduplicating backup program with built-in encryption and compression. Borgmatic is a wrapper that makes it easy to configure and schedule Borg backups.

Install Borg and Borgmatic

sudo apt install -y borgbackup
sudo pip3 install borgmatic

Initialize a Repository

# Local repository
borg init --encryption=repokey /backups/borg-repo

# Remote repository
borg init --encryption=repokey ssh://user@backup-server/backups/borg-repo

Save the passphrase securely — you cannot recover data without it.

Generate Borgmatic Config

sudo borgmatic config generate

Edit /etc/borgmatic/config.yaml:

repositories:
    - path: /backups/borg-repo

source_directories:
    - /var/www
    - /etc
    - /home

exclude_patterns:
    - "*.pyc"
    - "/var/www/*/cache"
    - "/home/*/.cache"

encryption_passphrase: "your-secure-passphrase"

retention:
    keep_daily: 7
    keep_weekly: 4
    keep_monthly: 6

compression: auto,zstd

hooks:
    before_backup:
        - mysqldump -u root --all-databases > /tmp/all-databases.sql
    after_backup:
        - rm /tmp/all-databases.sql

Schedule with Cron

# /etc/cron.d/borgmatic
0 3 * * * root borgmatic --verbosity 1 2>&1 | tee /var/log/borgmatic.log

Restoring Files

# List archives
borgmatic list

# List files in an archive
borgmatic list --archive latest

# Restore specific files
borgmatic extract --archive latest --path var/www/html/index.html --destination /tmp/restore/

# Restore entire archive
borgmatic extract --archive latest --destination /tmp/restore/

Why Borg?

• Deduplication — identical file chunks stored only once across all archives
• Encryption — AES-256 at rest, data never stored unencrypted
• Compression — zstd compression for fast, efficient storage
• Verification — built-in integrity checking with borgmatic check