AKGuidebooks Home Server Admin

Part 6: Security layer

33. Encrypted settings backup#

What you'll do: pack all the server's settings into one encrypted file, prove you can open it, and keep a copy on your computer. Time: 15 minutes.

This covers settings (SSH, firewall, services…), not your files. Chapter 17 backs up files.

flowchart LR
  E["Server settings<br/>/etc/..."] --> T["tar: pack"] --> G["gpg: encrypt<br/>with a passphrase"] --> F["config-DATE.tar.gz.gpg<br/>on the server"]
  F -- "scp" --> C["Copy on your<br/>Mac / PC"]

Step 1: Choose a passphrase#

Make a long passphrase and save it in your password manager as "homeserver settings backup". Without it the backup can't be opened.

Step 2: Make the backup#

Type on: the server
sudo -v
export GPG_TTY=$(tty)
mkdir -p ~/secure-backups && chmod 700 ~/secure-backups
backup=~/secure-backups/config-$(date +%Y%m%d-%H%M).tar.gz.gpg

Then (this is one long command):

Type on: the server
set -o pipefail; sudo tar -czf - -C / etc/ssh etc/ufw etc/fail2ban etc/apt/apt.conf.d etc/systemd/system etc/samba | gpg --pinentry-mode loopback --symmetric --cipher-algo AES256 -o "$backup" && chmod 600 "$backup" && echo "BACKUP OK: $backup"

Type the passphrase twice when asked. You must see BACKUP OK.

Adjust the list to your server

  • No file sharing? Remove etc/samba.
  • Have Part 5 (AI)? Add etc/ai-runtime home/alex/.config/systemd/user.
  • tar: ... Cannot stat: No such file or directory means a folder in the list doesn't exist on your server. Delete the half-made file with rm "$backup", remove that folder from the list, and run it again.

Step 3: Prove it opens (restore test)#

Type on: the server
test=$(mktemp -d)
gpg --pinentry-mode loopback -d "$backup" | tar -xzf - -C "$test" etc/ssh/sshd_config
sudo cmp /etc/ssh/sshd_config "$test/etc/ssh/sshd_config" && echo "RESTORE OK"
rm -r "$test"

Type the passphrase. You must see RESTORE OK. That means the file decrypts and its contents match the real settings.

Step 4: Copy it off the server#

Type on: your Mac or PC
scp 'homeserver:secure-backups/config-*.tar.gz.gpg' .

This puts it in the folder your terminal is in. Move it somewhere safe.

Keep in mind

  • The file contains Wi-Fi and other passwords, encrypted. Keep it encrypted; never unpack it on a shared computer.
  • Make a new one after every big change (for example after each chapter of this part).

Done when: BACKUP OK, RESTORE OK, and a copy is on your computer.

Next: 34. Final check and reboot test

Made by Anish · 2026