BorgBackup VPS for Encrypted Deduplicated Backup

BorgBackup compresses with zstd, deduplicates at the chunk level, and encrypts with AES-CTR plus HMAC-SHA256 before any byte leaves the client. Repositories grow only with genuinely new data which keeps long retention policies affordable. SSH is the only transport, which simplifies the attack surface to a single well audited protocol. No daemon, no API surface, no third party agent.

For a server hosting 20 Linux clients each backing up 50 GB nightly with monthly retention the actual repository size after a year typically lands around 600 to 900 GB instead of the 36 TB raw figure. That is the power of content addressed chunk dedup. AnubizHost VPS with 1 to 2 TB NVMe handles this workload comfortably with room to grow.

Create a dedicated borg user on the VPS with shell forced to borg serve via authorized_keys command directive. Add one SSH public key per client with a unique forced command path so each client lands in its own repository directory. Enable append only mode in the forced command to prevent any client from deleting historical archives - useful against ransomware that compromises a client and tries to wipe backups.

Pruning runs from a separate maintenance key that has full delete privileges. Run it weekly with borg prune --keep-daily 7 --keep-weekly 4 --keep-monthly 12. Verify integrity quarterly with borg check --verify-data. The whole setup is a few hundred lines of Ansible or shell scripts and runs without modification for years.

Hosting borg on a domestic cloud provider exposes the encrypted blobs to subpoena. Hosting on AnubizHost VPS in Romania, Iceland, or Finland moves the data to jurisdictions with stronger due process protections and no Five Eyes data sharing. The borg encryption is mathematically opaque without the passphrase, and the offshore venue means the encrypted blobs cannot be silently handed over to a foreign agency.

Combine with full disk encryption on the VPS itself for defense in depth. AnubizHost lets you install from custom ISO so LUKS encrypted root is straightforward. Pay in Monero for the strongest sender anonymity or Bitcoin if you prefer simpler tooling. No KYC, no real name, no card on file. Monthly renewal is automatic from crypto credit balance.