Skip to Content

Self-Host Borgmatic: Automated Encrypted Backups in 15 Minutes

Self-Host Borgmatic: Automated Encrypted Backups in 15 Minutes

September 11, 2026 | 12 min read

Your homelab is growing. You've got Docker containers running Plex, Nextcloud, maybe a few databases. But here's the uncomfortable question: when was your last backup? If your VPS dies tonight, how much data do you lose?

Most self-hosters skip backups because they seem complicated. Borgmatic changes that. It's a single configuration file that handles encrypted, deduplicated, compressed backups — automatically. In this guide, you'll have a working backup system running in 15 minutes.

Why Borgmatic?

Borgmatic wraps BorgBackup (the gold standard for deduplicating backup software) in a simple YAML config. Here's what you get:

  • Encryption at rest — AES-256 encryption, your data is safe even if the backup server is compromised
  • Deduplication — Store 30 days of backups in the space of 2-3 full backups
  • Compression — LZ4 or ZSTD compression saves bandwidth and storage
  • Automation — Scheduled backups with retention policies, no manual intervention
  • Multiple destinations — Local, remote SSH, S3-compatible storage (MinIO, Backblaze B2)

Prerequisites

  • A Linux VPS or homelab server with Docker installed
  • At least 2GB free disk space for backups (more if backing up large media libraries)
  • 5 minutes of your time

Step 1: Create the Directory Structure

mkdir -p ~/borgmatic/config
mkdir -p ~/borgmatic/backups
mkdir -p ~/borgmatic/data  # directories you want to back up
cd ~/borgmatic

Step 2: Create the Configuration File

Create ~/borgmatic/config/config.yaml:

# Borgmatic configuration
source_directories:
  - /data

repositories:
  - path: /backups
    label: local

# Encryption — SAVE THIS PASSPHRASE
encryption_passphrase: "YOUR_SECURE_PASSPHRASE_HERE_CHANGE_ME"

# Retention policy
keep_daily: 7
keep_weekly: 4
keep_monthly: 6

# Compression
compression: zstd

# Consistency checks
checks:
  - name: repository
  - name: archives

# Hooks for notifications (optional)
hooks:
  before_backup:
    - echo "Starting backup at $(date)"
  after_backup:
    - echo "Backup finished at $(date)"
  on_error:
    - echo "Backup failed!"
⚠️ Critical: Your encryption passphrase is the ONLY way to restore backups. Store it in a password manager. Lose it, lose your backups.

Step 3: Docker Compose Setup

Create ~/borgmatic/docker-compose.yml:

version: "3.8"

services:
  borgmatic:
    image: b3vis/borgmatic:latest
    container_name: borgmatic
    volumes:
      - ./config:/etc/borgmatic.d
      - ./backups:/backups
      - ./data:/data:ro  # read-only mount for safety
      # Add more directories to back up:
      # - /var/lib/docker/volumes:/docker-volumes:ro
      # - /home/user/documents:/documents:ro
    environment:
      - TZ=UTC
      - BORG_PASSPHRASE=${BORG_PASSPHRASE}
    restart: unless-stopped
    # Run backup on schedule (optional — see Step 5)
    command: sleep infinity

Create ~/borgmatic/.env:

BORG_PASSPHRASE=YOUR_SECURE_PASSPHRASE_HERE_CHANGE_ME

Step 4: Initialize and Test

cd ~/borgmatic
docker compose up -d

# Initialize the Borg repository
docker exec borgmatic borgmatic init --encryption repokey

# Create your first backup
docker exec borgmatic borgmatic create --verbosity 1

You should see output like:

Initializing repository at /backups
Encryption: AES-256
Creating archive at /backups::2026-09-11T06:00:00
------------------------------------------------------------------------------
Archive name: 2026-09-11T06:00:00
Duration: 0.02 seconds
Number of files: 42
------------------------------------------------------------------------------

Step 5: Automate with Scheduled Backups

Update docker-compose.yml to run backups automatically:

    command: >
      sh -c "
        while true; do
          borgmatic create --verbosity 1;
          borgmatic prune;
          borgmatic check;
          sleep 86400;
        done
      "

Or use a cron job on the host for more control:

# Edit crontab
crontab -e

# Add daily backup at 2 AM
0 2 * * * cd /root/borgmatic && docker compose run --rm borgmatic borgmatic create prune check

Step 6: Verify Your Backups

# List all backups
docker exec borgmatic borgmatic list

# Verify repository integrity
docker exec borgmatic borgmatic check --verify-data

# Test restore (extract to /tmp)
docker exec borgmatic borgmatic extract --destination /tmp/restore --archive latest

Step 7: Off-Site Backup to S3 (Optional but Recommended)

Local backups protect against accidental deletion. Off-site backups protect against fire, theft, and VPS provider failures. Add a remote repository:

repositories:
  - path: /backups
    label: local
  - path: s3:s3.amazonaws.com/my-backup-bucket
    label: offsite
    environment:
      AWS_ACCESS_KEY_ID: your-access-key
      AWS_SECRET_ACCESS_KEY: your-secret-key

Using MinIO instead? Just change the endpoint:

  - path: s3:https://minio.mydomain.com/backup-bucket
    label: minio
    environment:
      AWS_ACCESS_KEY_ID: minio-user
      AWS_SECRET_ACCESS_KEY: minio-password

Restoring a File (The Real Test)

Let's say you accidentally deleted an important document:


# Mount the backup as a filesystem (easiest way)
docker exec -it borgmatic borg mount /backups::latest /mnt

# Find your file
ls /mnt/data/documents/

# Copy it out
cp /mnt/data/documents/important.pdf /data/documents/

# Unmount
docker exec borgmatic borg umount /mnt

Monitoring Your Backups

Backups that silently fail are worse than no backups. Add healthchecks.io or Uptime Kuma monitoring:

hooks:
  after_backup:
    - curl -fsS -m 10 --retry 5 -o /dev/null https://hc-ping.com/YOUR-UUID-HERE
  on_error:
    - curl -fsS -m 10 --retry 5 -o /dev/null https://hc-ping.com/YOUR-UUID-HERE/fail

Next Steps

  • Database dumps — Add pre-backup hooks to dump PostgreSQL/MySQL before backing up
  • Multiple servers — Use Borgmatic on all your VPS instances, backup to a central location
  • Test restores monthly — A backup you haven't tested is a backup you don't have
  • Check out Kopia — A modern alternative with a GUI if Borg feels too CLI-heavy

Summary

You now have automated, encrypted, deduplicated backups running on a schedule. Your data is protected against hardware failure, accidental deletion, and ransomware. The entire setup fits in a single docker-compose.yml and a YAML config.

The best backup system is the one that runs without you thinking about it. Borgmatic is exactly that.

Questions? Drop a comment below or reach out on Discord.

This post is part of our Self-Hosting series. Next up: Self-Host Restic for distributed backups across multiple machines.

Self-Host MinIO: Your Own S3-Compatible Object Storage in 15 Minutes