Automated GDPR-Compliant Offsite Backups for Club Websites on Virtualmin: Strategies with BorgBackup, Restic, and Encrypted Cloud Storage Against Ransomware and Data Loss

Why Offsite Backups Are Indispensable for Club Websites

Club websites often contain sensitive member data, donation information, and municipal content. Data loss or a ransomware attack can not only render the club unable to act but also have legal consequences. The GDPR requires data controllers to implement appropriate technical and organizational measures to protect personal data – this includes regular, encrypted backups.

Many clubs rely on web hosting with Virtualmin, a powerful open-source control panel. Virtualmin does offer its own backup functions, but these are often insufficient when it comes to offsite storage, encryption, and automation. In this article, we show you how to build a robust backup strategy with BorgBackup, Restic, and encrypted cloud storage that is GDPR-compliant and protects you against ransomware.

Basics: GDPR Requirements for Backups

The GDPR requires not only the safeguarding of data but also its confidentiality, integrity, and availability. This means for your backup concept:

• Encryption: Backups must be stored encrypted, both in transit and at rest.
• Access control: Only authorized persons may access backups.
• Traceability: Backup processes must be documented and verifiable.
• Deletion concept: Backups must not be retained longer than necessary.
• Data processing agreement: For cloud backups, a data processing agreement (DPA) must exist with the provider.

Offsite backups are particularly important because they are stored geographically separate from the production system. This way, you are protected even in the event of a total server failure or a fire in the data center.

Virtualmin as a Basis for Automated Backups

Virtualmin offers an integrated backup function with which you can back up individual virtual servers or entire domains. These backups can be automated via Cron and output to various targets such as FTP, SSH, or Amazon S3. However, advanced features such as deduplication, incremental backups with versioning, and client-side encryption are often missing. This is where specialized tools like BorgBackup and Restic come into play.

If you don't yet have a Virtualmin server, you can find suitable virtual servers or web hosting packages with us that are ideal for club websites.

BorgBackup: Deduplication and Encryption

BorgBackup is a deduplicating backup program that creates incremental backups and only stores changed data blocks. It supports client-side encryption with AES-256 and offers compression. Borg is excellent for backing up Virtualmin servers because it efficiently handles large amounts of data.

Setting Up BorgBackup on a Virtualmin Server

First, install BorgBackup on your server. On Debian/Ubuntu, this is done with:

apt install borgbackup

Then create a repository on a remote server or in the cloud. Borg supports SSH, so you can set up an offsite repository with another provider or on a second server. Encryption is done with a passphrase, which you must keep safe.

A typical backup script could look like this:

#!/bin/bash
export BORG_PASSPHRASE='your-secure-password'
borg create ssh://backupuser@backup-server:22/./backup::'{now:%Y-%m-%d_%H:%M}' /home /var/www /etc
borg prune --keep-daily=7 --keep-weekly=4 --keep-monthly=6 ssh://backupuser@backup-server:22/./backup

This script creates a backup of the most important directories and deletes old backups according to a fixed schedule. You can run it daily via Cron.

Restic: Simplicity and Cloud Integration

Restic is another modern backup tool that stands out for its ease of use and broad cloud support. It supports backends such as Amazon S3, Google Cloud Storage, Microsoft Azure, Backblaze B2, and many more. Restic encrypts backups by default and offers deduplication.

Setting Up Restic for Virtualmin Backups

Installation is similarly straightforward:

apt install restic

Then initialize a repository in the cloud, e.g., with an S3-compatible provider:

restic -r s3:s3.amazonaws.com/your-bucket init

A backup script could look like this:

#!/bin/bash
export RESTIC_PASSWORD='your-secure-password'
restic -r s3:s3.amazonaws.com/your-bucket backup /home /var/www /etc
restic -r s3:s3.amazonaws.com/your-bucket forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

This script can also be automated via Cron. Restic also offers the ability to check backups (restic check) and restore them.

Encrypted Cloud Storage: GDPR-Compliant

When choosing cloud storage, you must ensure that the provider is GDPR-compliant. This means: server location in the EU, data processing agreement, and sufficient security measures. Many providers such as Backblaze B2, Wasabi, or the EU variants of AWS and Google Cloud offer corresponding certifications.

Important: Encryption should be client-side, i.e., before the data reaches the cloud. Borg and Restic do this by default. This way, your data remains protected even if the cloud provider is compromised.

Automation and Monitoring

Automated backups are only reliable if they are regularly monitored. Set up notifications if a backup fails. Borg and Restic provide exit codes that you can evaluate in your script. Send an email to the administrator on errors.

Additionally, you should regularly perform restoration tests to ensure that the backups work in an emergency. Only then can you react quickly in case of an emergency.

Conclusion: More Security for Your Club

With BorgBackup or Restic and encrypted cloud storage, you as a club on Virtualmin can implement a GDPR-compliant offsite backup strategy that protects you against ransomware and data loss. Automation via Cron saves time and reduces errors. Pay attention to strong passphrases, regular checks, and a GDPR-compliant cloud provider.

If you need support with setup or are looking for a suitable server, check out our virtual servers and web hosting offers. For domain-specific questions, visit our domain page.