How to Back Up a Linux Server to Cloud Storage with rclone
Tutorial 23 got your backups onto a second drive. That protects against a failed disk, not against a fire, a flood or a burglar who takes the lot. rclone copies files to more than forty cloud services — Backblaze B2, Google Drive, OneDrive, Dropbox, any S3 bucket — and can encrypt everything first so the provider only ever sees gibberish. One nightly cron line and your backups exist in two places.
Quick reference
| Task | Command | |
|---|---|---|
| Install | `sudo -v && curl https://rclone.org/install.sh | sudo bash` |
| Set up a provider | rclone config | |
| Test | rclone lsd remote: | |
| Copy up | rclone sync /mnt/backup remote:server-backup --progress | |
| Encrypted layer | rclone config → new remote, type crypt | |
| Restore | rclone copy remote:server-backup/file.tar.gz ~/restore/ |
1. Install
sudo -v && curl https://rclone.org/install.sh | sudo bash
rclone version
2. Pick a provider
- Backblaze B2 — cheapest for backups (fractions of a penny per GB a month), no browser login needed on the server. Recommended.
- Google Drive / OneDrive / Dropbox — fine if you already pay for space. Needs a one-off browser authorisation.
- Any S3 — Wasabi, Hetzner, Cloudflare R2, AWS.
3. Configure the remote
rclone config
Choose n (new remote), name it b2, pick the provider, and paste the key ID and application key from the provider's console. For Google Drive and the like, it opens a link to authorise — on a headless server say n to "use auto config", run the shown rclone authorize command on your laptop, and paste the token back.
Test it:
rclone lsd b2:
4. Add encryption
Create a second remote that wraps the first:
rclone config
n, name b2crypt, type crypt, remote b2:server-backup, encrypt filenames standard, and let it generate two passwords. Save those passwords somewhere other than this server — without them the backup is unreadable.
Everything you send to b2crypt: arrives in b2:server-backup encrypted, names and all.
5. Sync nightly
Add to /usr/local/bin/backup.sh (tutorial 23), after the local backup finishes:
rclone sync /mnt/backup b2crypt: --transfers 8 --log-file /var/log/rclone.log --log-level INFO
sync makes the remote match the local folder, deletions included. The local folder already keeps 30 days of dated archives, so the remote does too. Use copy instead if you'd rather nothing is ever deleted remotely.
Check /var/log/rclone.log the next morning for "Transferred" and no errors.
6. Restore
rclone ls b2crypt:
rclone copy b2crypt:etc-2026-10-08.tar.gz ~/restore/
Or mount the whole thing and browse it: rclone mount b2crypt: ~/cloud --read-only &.
Do this once now, not the first time you need it.
What to send
Not the whole server, and not every photo if you have Immich with 500 GB — the cost adds up. Prioritise: database dumps, /etc, Docker config folders, documents, the Vaultwarden data folder. Big media libraries can be re-ripped; your tax records can't.
Troubleshooting
"Failed to create file system: didn't find section in config file". The remote name is misspelt, or you ran it as a different user (config lives in ~/.config/rclone). Use sudo rclone --config /home/john/.config/rclone/rclone.conf ... from root's cron, or put the config in /root.
Google Drive stops working after a week. The token expired because the project is in "testing". Publish the OAuth app in Google Cloud console, or use a provider that uses keys.
Upload is slow. Raise --transfers and --checkers, and make sure it's running under tmux or cron rather than in a session that'll drop.
Lost the crypt passwords. The data is gone. This is why you wrote them down.
Wrapping up
Install, configure a provider, wrap it in crypt, add one rclone sync line to the nightly script. Your backups now survive anything that happens to the house, and the provider can't read a byte of them.
