BorgBackup: Deduplicated, Encrypted Backups for Linux Servers

Why BorgBackup?

Most backup tools store full copies or simple diffs. BorgBackup uses content-defined chunking to achieve true deduplication:

Space efficiency — 10 daily backups of 100 GB might use only ~110 GB total.
AES-256 encryption — Backups are encrypted at rest with a passphrase.
LZ4/zstd compression — Further reduces backup size.
SSH remote repos — Back up to any server with SSH access.

Prerequisites

Linux server (Ubuntu 22.04 or RHEL 9).
BorgBackup installed on both client and backup server (for remote repos).
SSH key-based access to the backup server (for unattended backups).

Step 1: Install BorgBackup

# Ubuntu/Debian
sudo apt install borgbackup -y

# Or via pip (latest version)
pip install borgbackup

Step 2: Initialize a Repository

Local Repository

borg init --encryption=repokey /backup/borg-repo

Remote Repository (SSH)

borg init --encryption=repokey user@backup-server:/backup/borg-repo

You’ll be prompted for a passphrase. This encrypts all backup data. Do not lose this passphrase.

Export the Key (Critical!)

borg key export /backup/borg-repo /safe/location/borg-key-backup.txt

Store this key file and passphrase separately from the backups.

Step 3: Create Backups

# Back up /etc, /home, and /var/www
borg create --stats --progress \
  /backup/borg-repo::{hostname}-{now:%Y-%m-%d_%H:%M} \
  /etc /home /var/www \
  --exclude '*.log' \
  --exclude '/home/*/.cache'

Output Example

Archive name: webserver-2026-02-27_14:00
Original size: 45.12 GB
Compressed size: 12.34 GB
Deduplicated size: 1.23 GB    ← Only new/changed data stored!

Step 4: Pruning Old Backups

borg prune --keep-daily=7 --keep-weekly=4 --keep-monthly=6 \
  /backup/borg-repo

Flag	What it keeps
`--keep-daily=7`	Latest backup from each of the last 7 days
`--keep-weekly=4`	Latest backup from each of the last 4 weeks
`--keep-monthly=6`	Latest backup from each of the last 6 months

Step 5: Automated Backup Script

#!/bin/bash
# /usr/local/bin/borg-backup.sh
export BORG_PASSPHRASE='your-passphrase-here'
export BORG_REPO='user@backup-server:/backup/borg-repo'

borg create --stats \
  $BORG_REPO::{hostname}-{now:%Y-%m-%d} \
  /etc /home /var/www \
  --exclude '*.log'

borg prune --keep-daily=7 --keep-weekly=4 --keep-monthly=6 $BORG_REPO
borg compact $BORG_REPO

Add to cron:

0 3 * * * /usr/local/bin/borg-backup.sh >> /var/log/borg-backup.log 2>&1

Troubleshooting

Problem	Solution
”Repository already locked”	Another borg process is running, or a previous one crashed. Run `borg break-lock /path/to/repo`
”Passphrase incorrect”	Double-check the BORG_PASSPHRASE env var; try typing it interactively
SSH connection timeout	Verify SSH key auth works manually; check firewall on backup server
Backup growing despite deduplication	Large files that change entirely (databases, VMs) defeat deduplication. Exclude them or use a database-specific tool
”No space left on device”	Run `borg prune` + `borg compact` to free space from deleted archives

Summary

Deduplication dramatically reduces backup storage requirements.
Always export your key and store the passphrase in a password manager.
Use borg prune with retention policies to prevent unbounded growth.
For databases, use pgBackRest or pg_dump + borg (not borg alone on live database files).

Frequently Asked Questions

What is BorgBackup and how is it different from rsync?

BorgBackup (borg) is a deduplicating backup tool with built-in encryption and compression. Unlike rsync, borg only stores unique data blocks across all backups, so 10 daily backups of a 100 GB server might use only 110 GB instead of 1 TB. It also provides authenticated encryption (AES-256) to protect backups at rest.

How does BorgBackup deduplication work?

Borg splits files into variable-length chunks using a rolling hash. Each chunk is identified by its content hash. If the same chunk exists in any previous backup, it's referenced (not re-stored). This means unchanged files and even unchanged parts of modified files use zero extra space.

Can I back up to a remote server with BorgBackup?

Yes. Borg supports SSH-based remote repositories. Install borg on both the client and the backup server. Initialize the repo as borg init user@backup-server:/path/to/repo, and all communications happen over encrypted SSH.

What happens if I lose my BorgBackup passphrase?

If you enabled encryption (repokey or keyfile mode) and lose the passphrase, your backups are permanently inaccessible. There is no recovery mechanism. Always store the passphrase in a secure password manager and export the key file (borg key export) to a separate safe location.