Back Up Your VPS Automatically with Restic and Cloudflare R2

By /

Back Up Your VPS Automatically with Restic and Cloudflare R2

VPS backup with Restic and Cloudflare R2 gives you encrypted, deduplicated, automated offsite backups — without paying for a managed backup service. This guide walks CM Cloud VPS users through the full setup in under 30 minutes.

If your VPS dies today, what do you recover from? If the answer is “nothing,” keep reading.

Why Restic + Cloudflare R2 Is the Best VPS Backup Stack in 2026

Restic is a modern, open-source backup tool that compresses, deduplicates, and encrypts your data before it ever leaves your server. Cloudflare R2 is an S3-compatible object storage service with zero egress fees — meaning you pay to store data but never to download it back. That combination makes it the most cost-effective offsite backup destination available.

For a VPS running on CM Cloud’s Cloud VPS ($7.99/mo, XAF 5,000 / €7.40), a complete Restic + R2 backup strategy typically costs under $0.50/month in storage fees for a typical 20–30 GB server.

What You Need Before You Start

  • A CM Cloud Cloud VPS (2vCPU / 4GB RAM / 80GB NVMe) — see CM Cloud pricing
  • A Cloudflare account (free tier is sufficient)
  • Root or sudo access to your VPS
  • About 30 minutes

Step 1: Create a Cloudflare R2 Bucket

  1. Log into your Cloudflare dashboard and navigate to R2 Object Storage.
  2. Click Create bucket and give it a name like vps-backups-myserver.
  3. Choose a region closest to your VPS location.
  4. Go to R2 > Manage R2 API Tokens and create a new token with Object Read & Write permissions scoped to your bucket.
  5. Note down your:
  6. Account ID (found in the Cloudflare dashboard sidebar)
  7. Access Key ID
  8. Secret Access Key
  9. Bucket name

Your R2 endpoint URL will be in the format:
https://<ACCOUNT_ID>.r2.cloudflarestorage.com

Step 2: Install Restic on Your VPS

SSH into your CM Cloud VPS and run:

apt update && apt install -y restic

Verify the installation:

restic version

You should see restic 0.16.x or later.

Step 3: Initialize the Restic Repository on R2

Restic treats your R2 bucket as a repository. You initialize it once, then every backup run adds a new snapshot.

First, export your credentials as environment variables (you will automate this in Step 5):

export AWS_ACCESS_KEY_ID="your_r2_access_key"
export AWS_SECRET_ACCESS_KEY="your_r2_secret_key"
export RESTIC_PASSWORD="a_strong_encryption_passphrase"

Important: RESTIC_PASSWORD is the encryption key for all your backups. Store it somewhere safe — a password manager, a separate secrets vault, or an offline document. If you lose it, your backups are unrecoverable.

Now initialize the repository:

restic -r s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET_NAME> init

Restic will confirm the repository was created.

Step 4: Run Your First Backup

Back up your entire /var/www directory (adjust the path for your use case):

restic -r s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET_NAME> \
  backup /var/www /etc /home

Restic will scan, deduplicate, compress, encrypt, and upload. On subsequent runs, only changed chunks are uploaded — making backups fast even over slow connections.

Verify your snapshots:

restic -r s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET_NAME> snapshots

Step 5: Automate with a Cron Job

Manual backups are not backups — they are intentions. Automate with cron.

Create a backup script at /usr/local/bin/restic-backup.sh:

#!/bin/bash
export AWS_ACCESS_KEY_ID="your_r2_access_key"
export AWS_SECRET_ACCESS_KEY="your_r2_secret_key"
export RESTIC_PASSWORD="your_encryption_passphrase"

REPO="s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET_NAME>"

# Run backup
restic -r "$REPO" backup /var/www /etc /home --quiet

# Prune old snapshots: keep 7 daily, 4 weekly, 3 monthly
restic -r "$REPO" forget --prune \
  --keep-daily 7 \
  --keep-weekly 4 \
  --keep-monthly 3

Make it executable:

chmod +x /usr/local/bin/restic-backup.sh

Add a cron job to run it daily at 2 AM:

crontab -e

Add this line:

0 2 * * * /usr/local/bin/restic-backup.sh >> /var/log/restic-backup.log 2>&1

Now your VPS backs itself up every night, prunes old snapshots automatically, and logs the result.

Step 6: Restore from a Snapshot

If disaster strikes, restoring is straightforward. List your snapshots:

restic -r s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET_NAME> snapshots

Restore to a target directory:

restic -r s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET_NAME> \
  restore latest --target /tmp/restore

Or restore a specific snapshot by ID:

restic -r s3:https://<ACCOUNT_ID>.r2.cloudflarestorage.com/<BUCKET_NAME> \
  restore abc12345 --target /tmp/restore

Because R2 has zero egress fees, restoring a full backup costs nothing beyond the time it takes to transfer.

What This Setup Protects You Against

Scenario Protected?
Accidental rm -rf ✅ Yes — restore from yesterday’s snapshot
VPS provider outage ✅ Yes — data is offsite on R2
Ransomware / file corruption ✅ Yes — encrypted, immutable snapshots
Disk failure ✅ Yes — offsite storage is independent
Data centre fire ✅ Yes — R2 is geographically distributed

VPS Hosting Comparison: Who Gives You a Rootable VPS to Back Up?

Provider Starter VPS (USD) XAF EUR Key Feature
CM Cloud $7.99/mo XAF 5,000 €7.40 Full root, NVMe, Africa-ready pricing
Hostinger $4.99/mo* ~XAF 3,100 ~€4.60 48-month lock-in, renews at $10.99/mo
DigitalOcean $6.00/mo ~XAF 3,700 ~€5.55 Popular globally, USD only
Hetzner €4.51/mo ~XAF 2,960 €4.51 EU-based, no African billing

*Hostinger’s $2.99/mo is a time-limited summer sale on shared hosting, not VPS. VPS pricing is separate and higher. All prices are point-in-time snapshots — verify before purchasing.

CM Cloud Cloud VPS is the only option on this list priced natively in XAF for Cameroonian and West African businesses, with no currency conversion risk and no surprise renewal markup. See full pricing at cmcloudhosting.com/pricing.

Security Best Practices for Your Restic Setup

  • Never hardcode credentials in a public repo. Keep your backup script outside version control, or use a secrets manager.
  • Test your restore. Run a restore into /tmp/restore monthly to confirm your backups are actually valid.
  • Protect RESTIC_PASSWORD separately from your server. If your VPS is compromised and the attacker gets the password, they can read your backups.
  • Restrict R2 token permissions to the specific bucket only — do not use your global Cloudflare API token.
  • Consider running restic check weekly to verify repository integrity:
restic -r "$REPO" check

Why CM Cloud VPS Is the Right Base for This Setup

The CM Cloud Cloud VPS gives you the full root access this setup requires — no restrictions on installing packages, running cron jobs, or managing your own backup strategy. At $7.99/mo (XAF 5,000 / €7.40) for 2vCPU / 4GB RAM / 80GB NVMe, it is the most affordable fully rootable VPS available to businesses in Cameroon and West Africa.

For developer-specific workflows on CM Cloud infrastructure — including CI/CD, auto-deploy hooks, and managed runtimes — see our App Hosting plans if your workload is application-based rather than a full VPS.

Ready to Back Up Your VPS?

Start your CM Cloud Cloud VPS today at $7.99/mo (XAF 5,000 / €7.40), follow this guide, and have automated encrypted backups running before midnight.

👉 Get your Cloud VPS at cmcloudhosting.com

No lock-in. No per-egress restore fees on R2. No excuses for running without a backup strategy in 2026.

Scroll to Top