Automate VPS VPN Config Backups

To ensure the safety of your VPN server configuration on a VPS and avoid manual setup in case of failure, you must perform automated backups of critical files like the control panel database (e.g., 3x-ui), SSH keys, TLS certificates, and proxy server configs (Xray, V2Ray) at least once every 24 hours, a crucial step for any self-hosted VPN user that reduces recovery or migration time to just 10-15 minutes instead of several hours.

Owning your own VPN server on a VPS provides unparalleled control over your online privacy and security. However, like any critical infrastructure, it's susceptible to risks: hardware failures, software bugs, accidental deletion, or even malicious attacks. In such situations, the absence of an up-to-date backup can lead to hours of downtime, loss of all user settings, and a complete server rebuild from scratch. This is why automated VPN server config backups are not just a recommendation but a mandatory practice for every administrator.

In this article, we'll delve into what exactly needs to be backed up, how to set up automatic creation and delivery of backups, which tools to use for encryption and storage, and most importantly, how to ensure your backup is truly functional. We'll also demonstrate how a properly configured backup can facilitate a rapid VPN migration to another server, minimizing downtime and effort.

What to back up for your VPN server on a VPS to avoid losing settings?

Effective VPN server config backups begin with understanding which data is critical. Unlike a full VPS image, which can span tens of gigabytes, a VPN server configuration backup typically weighs only a few megabytes, significantly simplifying its storage and transfer.

Key VPN Server Components Requiring Backup

When creating a backup of your VPN server on a VPS, you should include the following elements:

1. Control Panel Database: If you use a control panel like 3x-ui, X-UI, VLESS-Manager, or similar, all user information, credentials, traffic limits, and expiration dates are stored in its database. For 3x-ui, this is typically an SQLite file (/opt/3x-ui/db/x-ui.db or a similar path); for other panels, it might be MySQL or PostgreSQL. Without this database, user recovery will be impossible.
2. TLS Certificates and Private Keys: Secure protocols such as VLESS/VMESS/Trojan with TLS require domain certificates (.crt) and their corresponding private keys (.key). These are usually stored in directories like /etc/ssl/private/, /etc/ssl/certs/, or in directories used by Certbot (/etc/letsencrypt/live/your_domain/). These files are critical for establishing a secure connection.
3. Proxy Server Configuration Files: The main settings for Xray, V2Ray, Sing-box, or other proxy servers are contained in configuration files, for example, /etc/xray/config.json, /usr/local/etc/v2ray/config.json. These files define ports, protocols, routing, and other VPN operational parameters.
4. SSH Keys: If you use SSH keys to access your VPS (which is highly recommended), ensure you back up the public and private keys located in the ~/.ssh/ directory. While not directly related to VPN operation, this is crucial for secure server access itself.
5. Custom Scripts and systemd Unit Files: Any custom scripts you use for task automation or modified systemd unit files for service management (e.g., /etc/systemd/system/xray.service) should also be included in the backup.

Config Backup vs. Full VPS Image

A full VPS image, or "snapshot," is an exact copy of your entire virtual server's disk. It includes the operating system, all installed programs, data, and configurations. The advantage of a full image is its comprehensiveness: you can restore the server to its exact state at the time the snapshot was taken. However, there are drawbacks:

• Large Size: Images can be tens or hundreds of gigabytes, requiring significant storage space and long transfer times.
• Slow Recovery: Deploying a full image can take considerable time, especially for large servers.
• Less Flexibility: Restoring to a VPS with a different architecture or OS version can be problematic.

In contrast, a VPN server config backup focuses only on the most essential files. Its advantages include:

• Small Size: Typically a few megabytes, allowing for storage of multiple versions and quick transfers.
• Fast Recovery: You can quickly deploy a new OS, install the VPN server software, and simply copy over the configuration files, then start the services. The entire process takes no more than 10-15 minutes.
• High Flexibility: Configurations are easily portable between different OS versions or even to different architectures (e.g., x86 to ARM), provided the core components are compatible.

For a VPN server, where the OS and core packages are standardized, a config backup is the optimal and most pragmatic solution. For a deeper understanding of the VPN setup and configuration process on a VPS, we recommend reading our guide: VPN on Your Own VPS: A Complete Guide 2026.

Why is automated VPN config backup crucial for your VPS?

Many users, especially beginners, neglect regular backups until they encounter their first serious problem. However, for a VPN server, which is often a critical link for accessing information, automated VPN server config backups are not just good practice but a vital necessity.

Protection Against Unforeseen Situations and Minimizing Downtime

Server life is full of surprises. Here are a few scenarios where an up-to-date backup will save the day:

• Hosting Hardware Failure: Although VPS providers like Valebyte.com use highly reliable hardware, hardware failures cannot be completely ruled out. In the event of a physical server failure hosting your VPS, restoring from a backup on a new node is the only way to quickly bring the service back online.
• Filesystem or OS Corruption: A failed update, a configuration error, or an accidental command can corrupt the operating system or filesystem, rendering the VPS unusable.
• Administrator Errors: Human error is one of the most common causes of problems. Accidental deletion of an important file, incorrect configuration, or a change that "broke" the VPN can be easily fixed by restoring from the last working copy.
• Attacks and Compromise: In the event of a successful attack on your server, attackers may modify or delete configuration files. Having a backup allows you to quickly restore server functionality to its state before the incident.

Without an up-to-date backup, any of these situations would require completely rebuilding the VPN server, installing all components, generating new certificates, and manually adding all users. This process can take anywhere from several hours to a full day, resulting in prolonged service downtime and inconvenience for all users.

Facilitating Migration and Scaling

Beyond disaster recovery, automated backups significantly simplify other important operations:

• Rapid VPN Migration to Another Server: If you decide to switch VPS providers, upgrade your plan, or simply move your VPN to a server in a different geographical region, an up-to-date backup makes this process as quick and painless as possible. Instead of setting everything up from scratch, you simply deploy a new OS, install the necessary packages, and restore your configs. The entire process takes no more than 10-15 minutes, ensuring minimal downtime.
• Scaling: As the number of users grows, a more powerful VPS may be required. With config backups, you can easily transfer your configuration to a new, more performant server without the need for manual setup of each user.
• Testing: You can use a backup to deploy a test environment where you can experiment with new settings or updates without risking the stability of your main server.

Thus, automated VPN server config backups are an investment in the stability, reliability, and flexibility of your VPN infrastructure, which pays off at the first unforeseen situation or migration need.

How to set up automated 3x-ui and other VPN component backups?

Setting up automated backups doesn't require deep programming knowledge. With simple scripts and the Cron task scheduler, you can ensure regular backups of all critical files on your VPN server. We'll look at an example for the popular 3x-ui panel, but the principles apply to other configurations as well.

Creating a Script for Data Collection

The first step is to create a script that will collect the necessary files and package them into an archive. Assume the 3x-ui database is located at /opt/3x-ui/db/x-ui.db, the Xray configuration at /etc/xray/config.json, and Let's Encrypt certificates in /etc/letsencrypt/live/your_domain/. You can adapt the paths to your system.

Create a file, for example, /root/vpn_backup.sh, and add the following code to it:

#!/bin/bash

# --- SETTINGS ---
BACKUP_DIR="/var/backups/vpn_configs"
DATE=$(date +%Y-%m-%d_%H-%M-%S)
BACKUP_FILE="$BACKUP_DIR/vpn_configs_$DATE.tar.gz"
LOG_FILE="$BACKUP_DIR/backup.log"

# Paths to files and directories to back up
# Adapt these paths to your system!
FILES_TO_BACKUP=(
    "/opt/3x-ui/db/x-ui.db"
    "/etc/xray/config.json"
    "/etc/letsencrypt/live/your_domain/" # Replace with your domain
    "/etc/letsencrypt/archive/your_domain/" # Replace with your domain
    "/root/.ssh/id_rsa" # If using SSH keys
    "/root/.ssh/id_rsa.pub"
    # Add other important files/directories as needed
    # For example, if you have V2Ray: "/usr/local/etc/v2ray/config.json"
    # Or custom systemd unit files: "/etc/systemd/system/xray.service"
)

# --- FUNCTIONS ---
log_message() {
    echo "$(date +%Y-%m-%d_%H:%M:%S) - $1" | tee -a "$LOG_FILE"
}

# --- MAIN SCRIPT ---
log_message "Starting backup process."

# Create backup directory if it doesn't exist
mkdir -p "$BACKUP_DIR"
if [ $? -ne 0 ]; then
    log_message "Error: Failed to create directory $BACKUP_DIR. Check permissions."
    exit 1
fi

# Check for existence of files/directories before archiving
VALID_FILES=()
for file in "${FILES_TO_BACKUP[@]}"; do
    if [ -e "$file" ]; then
        VALID_FILES+=("$file")
    else
        log_message "Warning: File or directory not found: $file. Skipping."
    fi
done

if [ ${#VALID_FILES[@]} -eq 0 ]; then
    log_message "Error: No files to back up. Exiting."
    exit 1
fi

# Create archive
log_message "Creating archive: $BACKUP_FILE"
tar -czf "$BACKUP_FILE" "${VALID_FILES[@]}"
if [ $? -ne 0 ]; then
    log_message "Error: Failed to create archive. Check paths and permissions."
    exit 1
fi

log_message "Archive created successfully."

# Delete old backups (e.g., older than 7 days)
log_message "Deleting old backups (older than 7 days)."
find "$BACKUP_DIR" -type f -name 'vpn_configs_*.tar.gz' -mtime +7 -delete
if [ $? -ne 0 ]; then
    log_message "Warning: Failed to delete old backups. Check permissions."
fi

log_message "Backup completed."

Make the script executable:

chmod +x /root/vpn_backup.sh

Test it by running manually: /root/vpn_backup.sh. Ensure that an archive and log file appear in /var/backups/vpn_configs/.

Automation with Cron

Cron is a standard Linux task scheduler that allows you to execute scripts on a schedule. To set up daily 3x-ui backup automation and other configs:

1. Open the Cron table for editing:

   
   crontab -e
   

2. Add the following line to the end of the file to run the script every day at 03:00 AM:

   
   0 3 * * * /root/vpn_backup.sh >/dev/null 2>&1
   

Let's break down the Cron line:

• 0 3 * * *: This is the schedule. 0 means 0 minutes, 3 means 3 hours. The asterisks * mean "any value" for day of the month, month, and day of the week. So, every day at 03:00 AM.
• /root/vpn_backup.sh: The path to your script.
• >/dev/null 2>&1: This part redirects all script output (standard output and errors) to "nothing" to prevent cluttering the root mailbox with Cron system messages.

Save and close the file (usually Ctrl+X, Y, Enter for Nano). Now your vps backup automation is configured and will run daily. For more detailed information on 3x-ui migration, check out our article: Backup and Migration of 3x-ui to another VPS without losing users.

Encrypting and Storing your VPS Backup: S3, Telegram, and other options

Creating a backup is only half the battle. It's crucial not only to make regular backups but also to store them securely and encrypt them to prevent unauthorized access to sensitive data. Reliable storage of your VPS backup ensures that your data will be available when needed and remain confidential.

Choosing a Storage Location

Your backup storage location should be remote from your VPS so that in the event of a physical server failure or hosting issues, your backups are not lost. Here are a few popular options:

1. S3-compatible Storage: This is one of the most reliable and popular options. S3-compatible services offer high availability, scalability, and relatively low prices. Examples:
   • AWS S3: Market leader, but can be expensive for small volumes.
   • MinIO: Can be deployed on your own server to create private S3 storage.
   • Yandex Object Storage, Selectel S3, Space.ru S3: Regional alternatives, often more cost-effective.
   • Wasabi, Backblaze B2: Economical cloud storage with S3 API.
   For interacting with S3, you can use utilities like awscli or rclone.
2. Cloud Drives via rclone: rclone is a powerful tool for syncing files with many cloud storage providers, including Google Drive, Dropbox, OneDrive, Mega, and many others. It allows you to mount cloud drives as local folders or directly copy files.
3. Telegram (via bots): For small files and simple tasks, you can set up a Telegram bot to receive your backups. This is convenient as Telegram is accessible almost everywhere. However, this method is not suitable for large files and may have size and quantity limitations. Example usage:

   
   # Install curl and get your bot token and chat/channel ID
   BOT_TOKEN="YOUR_BOT_TOKEN"
   CHAT_ID="YOUR_CHAT_OR_CHANNEL_ID"
   BACKUP_FILE="/var/backups/vpn_configs/vpn_configs_$DATE.tar.gz" # Path to your archive
   
   # Send file to Telegram
   curl -F document=@"$BACKUP_FILE" "https://api.telegram.org/bot$BOT_TOKEN/sendDocument?chat_id=$CHAT_ID"
           

4. SCP/SFTP to another server: If you have a second VPS or a home server, you can use SCP (Secure Copy Protocol) or SFTP (SSH File Transfer Protocol) for secure backup transfers. This is simple and reliable but requires a second server.

Data Protection: Encrypting Your Backup

Since the backup contains sensitive data (keys, certificates, user data), it is crucial to encrypt it before sending it to remote storage. This protects your data even if the storage is compromised.

For encryption, you can use gpg (GNU Privacy Guard) with symmetric encryption:

# In your script after creating the archive:
# Encrypt archive with a passphrase
ENCRYPTED_BACKUP_FILE="$BACKUP_FILE.gpg"
GPG_PASSPHRASE="YOUR_STRONG_PASSWORD" # Replace with a very strong password!

log_message "Encrypting archive..."
gpg --batch --passphrase "$GPG_PASSPHRASE" --symmetric --cipher-algo AES256 -o "$ENCRYPTED_BACKUP_FILE" "$BACKUP_FILE"
if [ $? -ne 0 ]; then
    log_message "Error: Failed to encrypt archive."
    exit 1
fi
log_message "Archive encrypted successfully."

# Now send $ENCRYPTED_BACKUP_FILE to remote storage
# ... (commands for rclone, curl, scp, etc.)

# Delete unencrypted archive after successful upload
rm "$BACKUP_FILE"

Important: The encryption passphrase (GPG_PASSPHRASE) must be very strong and stored in a secure location, separate from the backup. Without it, you will not be able to decrypt your data.

For decryption:

gpg --batch --passphrase "YOUR_STRONG_PASSWORD" -o vpn_configs_RESTORE.tar.gz vpn_configs_2023-10-27_10-00-00.tar.gz.gpg

Integrating encryption and remote storage into your Cron script will ensure the complete security and availability of your VPS backup.

Restic and Borg: Advanced Server and Config Backup Solutions

While tar and gpg are excellent for simple scenarios, for more advanced and efficient backup, specialized tools like Restic or BorgBackup are recommended. These solutions offer several advantages, especially when it comes to VPS backup or general server backup.

Advantages of Restic and Borg

Restic and BorgBackup (often referred to as restic borg server backup) are designed for efficient and secure backup of large volumes of data, but they also work perfectly for smaller configs. Their key features include:

• Data Deduplication: This is a primary advantage. Restic and Borg split files into blocks and save only unique blocks. This means that during incremental backups (when only part of a file changes), only the modified blocks are saved, significantly saving storage space and speeding up the process.
• Incremental Backups: After the first full backup, all subsequent backups only copy changes, making them very fast and efficient in terms of traffic.
• Built-in Encryption: Both tools are inherently designed with security in mind and offer strong encryption for all data stored in the repository. You don't need to use gpg separately.
• Support for Multiple Backends:
  • Restic: Supports S3-compatible storage, SFTP, REST servers, Google Cloud Storage, Azure Blob Storage, Backblaze B2, Dropbox, and local disks.
  • BorgBackup: Primarily focused on SSH (SFTP) storage but can also use local and external disks.
• Versioning and "Snapshots": Both tools allow you to create "snapshots" of data at a specific point in time and easily restore to any previous version.
• Integrity Checking: Built-in data integrity verification mechanisms ensure that your backups are not corrupted.

Basic Setup and Usage

Let's look at an example of installing and basic configuring Restic for VPN server config backups to S3-compatible storage.

Installing Restic

# For Debian/Ubuntu
sudo apt update
sudo apt install restic

# Or download the binary from the official website and place it in /usr/local/bin
# wget https://github.com/restic/restic/releases/download/v0.16.2/restic_0.16.2_linux_amd64.bz2
# bunzip2 restic_0.16.2_linux_amd64.bz2
# sudo mv restic_0.16.2_linux_amd64 /usr/local/bin/restic
# sudo chmod +x /usr/local/bin/restic

Initializing a Restic Repository (S3-compatible storage)

Before using Restic, you need to initialize a repository. For S3, you'll need access keys (Access Key ID and Secret Access Key) and the URL of your S3-compatible service.

# Export environment variables for S3
export AWS_ACCESS_KEY_ID="YOUR_S3_ACCESS_KEY"
export AWS_SECRET_ACCESS_KEY="YOUR_S3_SECRET_KEY"
export RESTIC_REPOSITORY="s3:https://s3.your-region.example.com/your-bucket-name/path/to/repo"
export RESTIC_PASSWORD="YOUR_VERY_STRONG_REPOSITORY_PASSWORD"

# Initialize the repository
restic init

RESTIC_PASSWORD is the master password for the entire repository; it's used to encrypt all your backups. Store it in a safe place!

Creating a Backup

Now you can add the backup command to your script. Restic automatically handles deduplication and encryption.

#!/bin/bash

# --- RESTIC SETTINGS ---
export AWS_ACCESS_KEY_ID="YOUR_S3_ACCESS_KEY"
export AWS_SECRET_ACCESS_KEY="YOUR_S3_SECRET_KEY"
export RESTIC_REPOSITORY="s3:https://s3.your-region.example.com/your-bucket-name/path/to/repo"
export RESTIC_PASSWORD="YOUR_VERY_STRONG_REPOSITORY_PASSWORD"

LOG_FILE="/var/backups/vpn_configs/restic_backup.log"

# Paths to files and directories to back up
FILES_TO_BACKUP=(
    "/opt/3x-ui/db/x-ui.db"
    "/etc/xray/config.json"
    "/etc/letsencrypt/live/your_domain/"
    "/etc/letsencrypt/archive/your_domain/"
    "/root/.ssh/" # Can back up the entire .ssh directory
)

# --- MAIN SCRIPT ---
log_message() {
    echo "$(date +%Y-%m-%d_%H:%M:%S) - $1" | tee -a "$LOG_FILE"
}

log_message "Starting Restic backup process."

# Create backup
restic backup "${FILES_TO_BACKUP[@]}" --tag "vpn_configs" --verbose
if [ $? -ne 0 ]; then
    log_message "Error: Restic backup failed."
    exit 1
fi
log_message "Restic backup created successfully."

# Delete old snapshots (retention policy: e.g., keep last 7 daily, last 4 weekly)
log_message "Cleaning up old snapshots..."
restic forget --prune \
    --keep-last 7 \
    --keep-weekly 4
if [ $? -ne 0 ]; then
    log_message "Warning: Cleanup of old snapshots failed."
fi
log_message "Cleanup completed."

# Check repository integrity (can be run less frequently, e.g., once a month)
# log_message "Checking repository integrity..."
# restic check
# if [ $? -ne 0 ]; then
#     log_message "Warning: Repository integrity check revealed issues."
# fi
# log_message "Integrity check completed."

log_message "Restic backup completed."

Restoring Data

To restore data, you can view available snapshots and restore the necessary files:

# View available snapshots
restic snapshots

# Restore files from the latest snapshot to the current directory
# (or specify --path to restore specific files/directories)
restic restore latest --target /tmp/restore_test/

Using Restic or BorgBackup significantly enhances the reliability and efficiency of your backup process, making restic borg server backup a standard for serious system administrators.

Testing Backup Restoration: Why an Untested Backup is Useless

Creating backups is only the first step. Having gigabytes of archived files is meaningless if you cannot restore from them. "An untested backup is useless" is the golden rule for any system administrator. Regular restoration testing ensures that your backup efforts are not in vain and that you can indeed bring your server back to life in a critical situation.

The Importance of Regular Test Restorations

Why is testing so important?

1. Data Integrity Confirmation: Testing helps ensure that the files in the backup are not corrupted and can be successfully extracted. Sometimes archives can be damaged during creation or transfer.
2. Verification of Backup Configuration: You might have accidentally forgotten to include a critical file in the backup list, or file paths might have changed after a software update. Test restoration will reveal such gaps.
3. Practicing the Restoration Process: In a stressful situation (e.g., when your VPN is down and users are unhappy), it's easy to make mistakes. Regular restoration practice allows you to refine the process, remember commands and actions, minimizing the likelihood of errors in a real emergency.
4. Compatibility Check: If you plan to migrate your VPN to another server with a new OS version or a different provider, a test restoration will show whether your configurations are compatible with the new environment.

How to Conduct a VPN Config Restoration Test

An ideal restoration test simulates a real-world scenario but without risk to your live server. Here are a few approaches:

1. On a Temporary VPS:
   • Order the cheapest temporary VPS from the same or another provider (e.g., Valebyte.com offers plans starting from $5/month).
   • Install a clean OS on it (e.g., Ubuntu Server).
   • Install the minimally required packages for your VPN (e.g., Xray, Nginx, Certbot, if used).
   • Copy your encrypted backup to this temporary VPS.
   • Decrypt and unpack the archive.
   • Place the configuration files and certificates in the correct locations.
   • Start the VPN service (e.g., systemctl start xray).
   • Verify functionality: try connecting to the VPN with a test client, ensure traffic flows.
   • After a successful test, delete the temporary VPS.
2. In a Docker Container:
   • If you have a local computer or another server with Docker, you can create a temporary container.
   • Deploy a base OS within it, install necessary packages.
   • Restore configs inside the container and start the VPN.
   • Check connectivity (port forwarding may be required).
   • Remove the container.
   This method is faster and more economical but requires familiarity with Docker.
3. On a Local Virtual Machine:
   • Use VirtualBox, VMware, or KVM on your computer.
   • Create a new virtual machine, install the OS.
   • Follow the restoration steps similar to a temporary VPS.

Testing Frequency: It is recommended to perform a test restoration at least once every 1-3 months or after any significant change to your VPN server's configuration (e.g., domain change, Xray update, major OS update).

The 15-30 minutes spent on a test restoration are nothing compared to the hours or days of downtime that can result from a non-functional backup. Ensure your VPN server config backup is truly a lifeline, not just a collection of files.

Quick VPN Server Migration to a New VPS using Backups: A 10-Minute Guide

One of the most powerful benefits of a well-configured and tested VPN server config backup is the ability to quickly and almost seamlessly migrate your VPN to a new VPS. Whether it's changing hosting providers, upgrading your plan, or simply needing to deploy a VPN in a different region, a backup allows you to minimize downtime. This process, including VPN migration to another server, can be completed in just 10-15 minutes.

Step-by-Step Migration Plan

Assuming you already have an up-to-date backup and have performed a test restoration, here's how the migration process looks:

1. Prepare the New VPS (2-3 minutes):
   • Order a new VPS from Valebyte.com or another provider. Choose a plan that meets your needs (see table below).
   • Install a clean operating system (e.g., Ubuntu 22.04 LTS). Ensure it matches the OS on the old server or is a compatible version.
   • Update the system and install basic utilities:

     
     sudo apt update && sudo apt upgrade -y
     sudo apt install curl wget unzip tar -y
     

   • Install the necessary VPN server components, but without configuration for now:

     
     # For example, for Xray
     bash -c "$(curl -L https://raw.githubusercontent.com/XTLS/Xray-install/main/install-release.sh)" @ install
     # Or for 3x-ui (installer only, without running the setup wizard)
     # bash <(curl -Ls https://raw.githubusercontent.com/mhsanaei/3x-ui/master/install.sh)
     

2. Transfer and Restore Backup (5-7 minutes):
   • Copy your encrypted backup to the new VPS. Use scp, wget from a direct link (if backup is in S3), or rclone copy.

     
     # Example with S3 via rclone (assuming rclone is already configured)
     # sudo apt install rclone -y
     # rclone copy remote:your-bucket/path/to/backup/vpn_configs_LATEST.tar.gz.gpg /root/
     

   • Decrypt and unpack the archive:

     
     cd /root/
     gpg --batch --passphrase "YOUR_STRONG_PASSWORD" -o vpn_configs_RESTORE.tar.gz vpn_configs_LATEST.tar.gz.gpg
     tar -xzf vpn_configs_RESTORE.tar.gz -C /
     

     Warning: Unpacking with -C / means restoring files to their original paths (e.g., /etc/xray/config.json). Ensure you understand where the files will be unpacked to avoid overwriting anything unintentionally.

   • Restore the panel database if it was in a separate file (e.g., for 3x-ui):

     
     # If 3x-ui is already installed, stop it before replacing the DB
     # systemctl stop 3x-ui
     mv /root/opt/3x-ui/db/x-ui.db /opt/3x-ui/db/x-ui.db
     # systemctl start 3x-ui
     

   • Update IP addresses in the configuration if they were hardcoded. Typically, modern VPN servers use domain names, so this is not required. If IP addresses are used, edit /etc/xray/config.json or a similar file.
3. Start and Verify (1-2 minutes):
   • Restart or start all VPN services and the control panel:

     
     systemctl daemon-reload
     systemctl restart xray
     # systemctl restart 3x-ui # If using a panel
     # systemctl restart nginx # If using Nginx for proxying or Certbot
     

   • Check service logs for errors:

     
     journalctl -u xray -f
     # journalctl -u 3x-ui -f
     

   • Test the VPN connection from a client. Ensure everything is working stably.
   • After a successful migration, you can safely delete the old VPS.

This process allows for VPN migration to another server with minimal effort and downtime, confirming the value of automated backups. For more general migration recommendations, you can read our article: How to Migrate a Website to Another Host Without Downtime: A Step-by-Step Guide.

VPS Resources for a VPN Server: Optimal Choice

Choosing the right VPS for your VPN server depends on the number of users and the anticipated load. For 50 concurrent users, 4 vCPU, 8 GB RAM, and an 80 GB NVMe disk are sufficient.

Users	vCPU	RAM	Disk	Port	Price (Estimated)
1-10	1-2	1-2 GB	20-40 GB NVMe/SSD	1 Gbps	$5-10/мес
10-25	2	2-4 GB	40-60 GB NVMe/SSD	1 Gbps	$10-20/мес
25-50	4	4-8 GB	80-100 GB NVMe	1 Gbps	$20-40/мес
50-100	6-8	8-16 GB	100-160 GB NVMe	1-2.5 Gbps	$40-80/мес
100+	8+	16+ GB	160+ GB NVMe	2.5+ Gbps	$80+/мес

Note that NVMe disks provide significantly higher read/write speeds compared to regular SSDs, which is critical for server performance, especially with a large number of concurrent connections.

Frequently Asked Questions

We've compiled answers to the most common questions about automated VPN server config backups to help you better understand the topic.

How often should I back up my VPN configs?

The frequency of backups depends on how often changes occur on your VPN server. If you regularly add or remove users (e.g., 5-10 times a day), it's recommended to perform backups every 6-12 hours. For servers with a stable user list and infrequent changes, a daily backup, for instance, once every 24 hours, is sufficient. Using incremental systems like Restic allows for hourly backups without significant resource consumption.

Where is the best place to store config backups?

The best place to store backups is a remote, geographically distributed storage location, separate from where your VPS is hosted. S3-compatible cloud services (AWS S3, Yandex Object Storage, Backblaze B2) are ideal due to their high availability, reliability, and relatively low cost. For very small volumes, encrypted storage on another VPS or even in Telegram via a bot can be considered, but with awareness of size and reliability limitations.

Is it mandatory to encrypt backups?

Yes, encrypting backups is a mandatory security requirement. Your backups contain sensitive data such as private certificate keys, user credentials, and access settings. If such a backup falls into the wrong hands without encryption, it could lead to the compromise of your VPN server and all its users. Use strong encryption methods, such as GPG with AES256 or the built-in encryption of Restic/BorgBackup, with a very strong password.

Can backups be used to update a VPN server?

VPN server config backups can be used as a safeguard during updates, but not as the primary update method. Before a major update to Xray, the 3x-ui control panel, or the operating system, always perform a full backup. If problems arise after the update, you can quickly restore to the previous state. However, for the update process itself, it is recommended to follow the developers' official instructions rather than attempting to "transfer" old configs to a new version without checking compatibility.

How much space does a VPN config backup take?

A VPN server config backup typically takes up very little space. For example, an archive containing the 3x-ui database, Xray configuration, and all TLS certificates usually weighs from a few hundred kilobytes to a few megabytes (e.g., 2-5 MB). Using deduplication tools like Restic can further reduce the storage footprint when keeping many incremental copies, making the storage of dozens of backup versions extremely economical.

Conclusion

Automated VPN server config backups are not just an option but a fundamental necessity for ensuring the stability and security of your VPN infrastructure. Regularly creating encrypted backups and storing them on remote S3-compatible storage using tools like Restic minimizes data loss risks and enables rapid VPN migration to another server in just 10-15 minutes. Never neglect testing your restorations, as only a tested backup is truly reliable.