Home server backups: Restic vs Borg vs Duplicati
A home server holds the only copy of your photos, files, and wallet configs until you make a second one somewhere else.
Back up a home server with the 3-2-1 rule: three copies of your data, on two separate devices, with one copy off site. For most people I would pick Restic, which encrypts everything it writes, deduplicates, and can write to a local disk, an SFTP server, or an S3-compatible bucket. For a Bitcoin node box, skip the blockchain, because it re-downloads, and back up wallet exports, Lightning channel backups, app configs, and your Immich and document data. A seed phrase never goes in any digital backup.
What a Bitcoin node box needs backed up
A bitcoiner runs a home server to keep a Bitcoin node, photos, and files under their own control, and that makes backups their job. No cloud company is holding a second copy for you. The first decision is what to leave out, because the blockchain is hundreds of gigabytes and costs you nothing to re-download. Start9 says the same in its own docs: Bitcoin excludes the blockchain from StartOS backups, since it can be recovered by re-syncing.
| Item | Back it up? | Why |
|---|---|---|
| Bitcoin blockchain data | No | It re-syncs from the network. It is the largest thing on the box and the cheapest to lose. |
| Seed phrase | Never digitally | Paper or steel only, never in a backup tool, a photo, or a password manager. See how to back up a seed phrase. |
| Wallet files and descriptor exports | Yes | Bitcoin Core says a wallet must be backed up with its built-in backup function to be safe, and to make a fresh backup after you change its passphrase. Sparrow stores its data, wallets included, in a folder in your home directory. |
| Lightning channel backups | Yes, after every channel open or close | LND updates its channel backup file each time a channel is opened or closed, and warns that copying the live channel database is dangerous because you never know if it holds the latest channel state. Start9 notes that LND's channel backup is only current to the moment the backup was taken. The details are in run a Lightning node. |
| Electrum server and app configs | Yes | Config files are tiny, and they hold choices you made. Copy them with your other app data. |
| Immich photos | Yes | Immich says only the original content is critical: the library, upload, and profile folders, plus the database backups Immich writes. See Immich and Nextcloud for the apps themselves. |
| Paperless documents | Yes | Paperless-ngx says to back up the entire paperless folder on a bare-metal install, plus the database if you use PostgreSQL or MariaDB, or its Docker volumes on a Docker install. Its document exporter works for any install and writes documents, thumbnails, metadata, and database contents to one folder. |
The seed phrase is the one item I would never put in a tool on this list. A backup repository is an encrypted copy of files on a networked machine, and a seed phrase belongs somewhere no network can reach. The keys themselves belong on a hardware wallet, never on the server.
The 3-2-1 rule
The 3-2-1 rule is a common backup guideline, and Backblaze describes it as keeping three copies of your data on two different media with one copy off site.
On a home server, that looks like this. Copy one is the live data on the server. Copy two is a backup on a separate USB or external drive. Backblaze says the two-media part now means two separate devices, so a drive apart from the server counts. Copy three is off site: a second box at a relative's house, or an encrypted bucket in someone else's data center. The off-site copy survives a fire or a burglary.
RAID does not count as a backup. Synology's docs say RAID (classic and SHR) is not a backup solution, even though an array can be built to survive one or two failed drives.
Restic vs Borg vs Duplicati
All three tools can encrypt, deduplicate, and keep many snapshots without storing every file again. They differ in where they can send data and how you run them.
| Restic | Borg | Duplicati | |
|---|---|---|---|
| Licence | BSD 2-Clause | BSD 3-clause | MIT for the core; a proprietary folder has its own licence |
| Encryption | Always on: AES-256 with Poly1305-AES | You choose a mode at init: repokey, keyfile, authenticated, or none. Repokey and keyfile encrypt with AES-256 on the client; authenticated and none do not encrypt | Optional AES-256 or GPG, applied before upload; the setup page calls encryption generally a good idea to add and warns you cannot recover anything if the passphrase is lost |
| Deduplication | Yes, content-defined chunking | Yes, content-defined chunking | Yes, block-level, with compression |
| Destinations | Local, SFTP, REST server, S3-compatible, B2, Azure, Google Cloud, and others through rclone | A local path or an SSH host; the repository-URL docs list no S3 or cloud backends | Local path, SFTP, S3-compatible, WebDAV, SMB, B2, and many cloud providers, per its destination list |
| Interface | Command line | Command line | Web UI in the browser, per its install docs |
| Check and restore tests | A built-in check command, with an option to verify every data file | A built-in check command, with an option for a full integrity check | After each backup it checks the remote storage and downloads a few random volumes; the setup page's built-in test checks the connection only |
Both Restic and Borg warn about the same thing as Duplicati: lose the password and the data is gone. Restic's docs say losing it means your data is irrecoverably lost. Borg's docs say you always need both the key and the passphrase, and to keep a backup of the key outside both the repository and the system you back up. Store that password somewhere other than the server it protects.
Which one I would pick
- Most people with a home server and a cloud bucket or a second box: Restic. One binary, encryption you cannot forget to turn on, and a longer list of destinations than Borg.
- People whose off-site copy is another Linux box with SSH: Borg. It works well over SSH, and its repository docs cover local paths and SSH hosts only, so a bucket needs a different tool.
- People who want a browser dashboard and no terminal: Duplicati. Its web UI sets up jobs, schedules, and destinations. Do a test restore early, because its after-backup check samples only a few volumes.
- People running StartOS or umbrelOS: use the built-in backup first, then add one of the tools above for the data it skips.
Pick one tool and stay with it, and restore from it once before you need to.
Off-site options
The first option is a second box at a relative's house: an old mini PC or Raspberry Pi with a big drive, reachable over SSH or a private network. It costs only hardware and electricity, and you control it. The drawbacks are that you maintain it, and the relative's internet connection and power are now part of your backup plan.
The second option is an S3-compatible bucket with client-side encryption, which suits Restic and Duplicati. Because the tool encrypts before upload, the provider stores ciphertext it cannot read. Backblaze B2 is one example. Its pricing page lists B2 starting at $6.95 per TB per month as of November 2026, with the first 10 GB free and downloads free up to three times your average monthly stored data, then $0.01 per GB. It also describes B2 as S3-compatible object storage. Restic's docs recommend using Backblaze's S3-compatible API rather than the native B2 backend.
Built-in backups on StartOS and umbrelOS
StartOS backs up the services you select. Its docs say backups are encrypted with your master password, go to a drive plugged into the server or a network folder on your LAN, and stop each running service for the duration. Services may exclude files: Bitcoin leaves out the blockchain, and the docs call out that LND's channel data is only a snapshot.
umbrelOS advertises encrypted backups every hour to a USB drive, a NAS, or another Umbrel, with hourly copies kept for 24 hours, daily for a week, weekly for a month, and monthly for a year. I did not find a page that lists what umbrelOS includes or excludes, so check which apps are covered before you count on it.
Both land on your own network, which makes them copy two. You still owe yourself an off-site copy three. Compare the two systems in Start9 vs Umbrel, and see how to build a home server for the hardware.
Frequently asked questions
What is the 3-2-1 backup rule?
Keep three copies of your data on two different kinds of media, with one copy off site. Backblaze uses this wording, and it is a widely repeated rule of thumb.
Is Restic better than Borg?
Neither is better in general. Restic writes to local disks, SFTP, S3-compatible buckets, and many more destinations. Borg is a good fit when your backup target is a machine you reach over SSH.
Do I need to back up the Bitcoin blockchain?
No. The blockchain re-downloads from the network, and StartOS leaves it out of its own backups for that reason. Back up wallet exports, Lightning channel backups, and your app configs instead.
Should I put my seed phrase in my backup?
Never. A seed phrase belongs on paper or steel, away from any connected device. My guide to backing up a seed phrase explains how.
How do I know my backup works?
Restore a few files to another folder and open them. Restic and Borg also have check commands with deeper verification options. Repeat the test after any change to the setup.