Remote backup — cron + rsync, version control commit, S3 bucket

The remote backup is the operator’s defence against the loss of the router’s local storage. The local file (/config/config.boot) is on the router’s disk; a disk failure, an accidental deletion, or a compromise can destroy the file. The remote backup is on a separate system that the failure cannot affect.

A production remote backup has three locations:

1. Off-box file server — the local file server in the operator’s network. The rsync copies the file here every hour (or after every save).
2. Version control repository — the Git repository that holds the full history of every change. The off-box file is committed here after every rsync.
3. Off-site archive — the S3 bucket (or equivalent) that holds the file in a separate geographic region. The off-site archive is the operator’s defence against the loss of the entire data centre.

This lesson covers the cron-driven rsync, the Git commit, the S3 archival, and the production failure modes where the remote backup is missing or stale.

Cron-driven rsync

A cron job runs on a schedule (every hour, every 6 hours, or after every save) and rsyncs the saved configuration to an off-box file server:

# VyOS configuration — cron job to rsync the configuration
set system task-scheduler task rsync-config executable path /usr/bin/rsync
set system task-scheduler task rsync-config executable arguments /config/config.boot backup@backup.internal:/srv/configs/edge-01-config.boot
set system task-scheduler task rsync-config interval 1h

The cron job runs every hour. The rsync copies the router’s /config/config.boot to the off-box file server at backup.internal:/srv/configs/. The off-box file is named edge-01-config.boot (one file per router).

# Equivalent crontab on the off-box file server
0 * * * * rsync -a vyos@edge-01.internal:/config/config.boot /srv/configs/edge-01-config.boot

The off-box file server has the latest configuration within the rsync interval (typically one hour). A configuration change that is made at 14:00 is backed up to the off-box file server at 15:00.

Git commit

The off-box file is committed to a Git repository after every rsync. The commit captures the change with a timestamp and a router identifier:

# Cron job on the off-box file server
0 * * * * cd /srv/configs && git add . && git commit -m "edge-01: $(date -Iseconds)" && git push origin main

The Git repository has the full history of every change. The operator can recover any previous state by checking out the corresponding commit:

# Recover the configuration as it was on 2026-08-15
git checkout $(git log --until="2026-08-15" --format="%H" -1) -- edge-01-config.boot

The Git repository is the operator’s primary backup. The off-box file is the working file for the next commit; the Git repository is the versioned history.

S3 bucket archival

The off-box file is uploaded to an S3 bucket (or equivalent object storage) for off-site disaster recovery. The S3 bucket is in a separate geographic region from the data centre:

# Cron job on the off-box file server
0 1 * * * aws s3 cp /srv/configs/edge-01-config.boot s3://company-vyos-backups/edge-01/$(date +%Y-%m-%d)-config.boot

The S3 bucket is the operator’s defence against the loss of the entire data centre. A fire, a flood, or a regional disaster that destroys the data centre also destroys the off-box file server; the S3 bucket survives because it is in a separate region.

flowchart LR
  R[Router\n/config/config.boot] -->|rsync hourly| FS[Off-box file server]
  FS -->|git commit| G[Git repository]
  FS -->|S3 daily| S3[S3 bucket\nseparate region]

The diagram shows the three-location backup chain: the router has the local file; the off-box file server has the hourly rsync; the Git repository has the versioned history; the S3 bucket has the off-site archive. A single failure cannot destroy all three locations.

Failure modes

Cron job not running

The cron job is configured but not running (e.g. the task scheduler is disabled, the cron daemon is stopped). The off-box file is stale; the Git repository is stale; the S3 bucket is stale.

Diagnostic: the off-box file’s timestamp is older than the expected interval. The Git repository’s most recent commit is older than the expected interval.

Fix: investigate the cron job. The defensive idiom: the cron job’s success is monitored (Prometheus exporter, log message, Git commit); a stale backup triggers an alert.

Off-box file server unreachable

The off-box file server is unreachable (network outage, server failure). The cron job fails; the off-box file is not updated.

Diagnostic: the cron job logs show connection failures.

Fix: restore connectivity to the off-box file server. The defensive idiom: the off-box file server has its own monitoring; an unreachable server triggers an alert.

S3 credentials expired

The S3 credentials (access key, secret key) expire. The cron job fails to upload; the S3 bucket is not updated.

Diagnostic: the cron job logs show AWS authentication errors.

Fix: rotate the S3 credentials. The defensive idiom: S3 credentials are stored in a vault; rotation is on a schedule (90 days typical).

Git repository not pushed

The cron job commits locally but does not push to the remote. The local commit is on the off-box file server; the remote is empty.

Diagnostic: git log on the remote shows no recent commits; git log on the local shows recent commits.

Fix: push to the remote. The defensive idiom: the cron job pushes after every commit; the push failure triggers an alert.

Rollback

A remote backup-driven recovery is the standard mechanism:

1. Identify the desired configuration revision (from the ticket, from the Git history, from the operator’s memory).
2. Check out the desired commit from the Git repository.
3. Copy the file to the router (/config/config.boot).
4. Reboot the router (or load and commit to apply the file).

The VyOS commit validator catches invalid configurations; the recovery is safe to run automatically.

Production discipline

Cross-course references

• LV-VyOS-Backup (vyos-lv-01-saved-configuration, the previous lesson) covers the saved configuration that the remote backup captures.
• LV-VyOS-Backup (vyos-lv-03-restore-same-appliance, the next lesson) covers the restore procedure that the remote backup enables.
• LIV-VyOS-Automation (vyos-liv-03-config-as-code) covers the configuration-as-code pipeline that integrates with the remote backup.

Quiz