BORG

Self-hosting

Borg server operations

The Get started guide covers installation, loopback setup, first startup, and creating a cube. This page covers private-LAN configuration before setup and the routes to lifecycle, backup, restore, and recovery guidance afterward. The borg client provides the commands shown here.

Network configuration

Loopback is the safe default: only programs on this computer can reach the server. For private-LAN access, Get started points here before you run borg setup; this section has the complete sequence.

BORG_SERVER_BIND_HOST is read during setup and written into the server certificate, so setting it before setup is the shortest path. Set it on the setup command itself, replacing the example with this server's private-LAN address.

BORG_SERVER_BIND_HOST=192.168.1.20 borg setup

An existing server can have a private-LAN address added afterwards — borg server cert-reissue --host 192.168.1.20 reissues the certificate in place rather than recreating the server's identity — but that needs the server stopped and ca.key returned to the data directory from wherever you moved it. Public, wildcard, unspecified, multicast, and other unsafe bind addresses are rejected.

Starting the server does not reuse that address. The bind address comes from the command line, so a LAN server is started with both the address and explicit --lan consent; --lan records that you meant to leave loopback, and is not a firewall.

borg server start --host 192.168.1.20 --lan

Before that first LAN start, move ~/.borg/server/ca.key to encrypted offline storage readable only by you, and confirm it no longer exists in ~/.borg/server. Keep ca.crt, server.crt, and server.key in place. LAN startup intentionally refuses to run while ca.key remains in the server data directory.

TLS files may instead be supplied explicitly with BORG_SERVER_TLS_KEY_FILE, BORG_SERVER_TLS_CERT_FILE, and BORG_SERVER_TLS_CA_FILE.

Lifecycle, backup, and recovery