I've been running this setup for a while and figured I'd document it. The goal is simple: cheap storage VPS as immutable backup target, client holds the keys, provider sees only encrypted blobs.
Architecture:
- Client: your main VPS or homelab box
- Target: storage VPS with SSH access, nothing else running
- Borg init with --append-only on the repo
- SSH forced command restricting to borg serve
The append-only flag means even if client is fully compromised, attacker cannot prune or delete old archives. They can only append. Recovery from client compromise: copy repo elsewhere, strip attacker archives with borg delete --force locally, re-init.
SSH config on target:
Command="borg serve --append-only --restrict-to-path /backups/client1",restrict-ed25519 AAAAC3...
One repo per client. No shared paths.
Client side: export BORG_PASSPHRASE or use keyfile. I prefer keyfile with passphrase via systemd credential or similar.
Cost at our fictional providers: ~$4/TB/month. Cheaper than S3 for warm archives, more control than rsync.net.
Caveat: this does not protect against a malicious provider. They can delete the whole VPS. Offsite to second provider for anything critical.
Questions or improvements welcome. :)
— Admin
