Borg Backup Server is an open-source, self-hosted enterprise backup platform built on BorgBackup. It adds the control plane enterprise teams expect: zero-trust agents for Linux, macOS and Windows, policy-based plans, browser restores, database-aware plugins, offsite replication, enterprise identity and a companion mobile app. It is MIT licensed, with no license keys, no paid edition and no hosted control plane. Since its public launch in February 2026, BBS has passed 800,000 downloads and 320 GitHub stars. More than 1,000 servers now protect over 4,000 endpoints with it.
From internal tool to public platform
I ran the first version inside my own hosting company for years. In 2026 I rebuilt it from the ground up and released it as a product. I own the whole system: product direction, architecture, code, automation, interface design, the website, documentation, releases and the companion app. I also run the open-source product loop, turning feedback, issues and pull requests into decisions and shipped improvements.
BBS is the clearest example of how I work. Start with a real operational problem. Design the platform around security and the user. Automate deployment and maintenance. Ship in short cycles. Listen closely. Keep every layer moving together.
For security teams
- Zero trust by design. The server never opens a connection to a client and holds no credentials for client systems. Agents pull work from the server over HTTPS, outbound only, so nothing needs an inbound port and everything works behind NAT and firewalls. A compromised backup server gives an attacker no path into production.
- Append-only repositories. Agents can create archives but can never delete, modify or overwrite existing ones. Enforced with SSH forced commands running
borg serve --append-only; only the server prunes, and only through retention policy. Ransomware on an endpoint cannot destroy its own history. - Enterprise login. TOTP two-factor authentication that admins can enforce for every account, with bcrypt-hashed single-use recovery codes. OIDC single sign-on. Role-based access control with per-client permissions for backup, restore, repository management and maintenance. Per-agent API keys.
- Encryption everywhere. Repository passphrases, SSH private keys and TOTP secrets are encrypted at rest with AES-256-GCM under a server-specific key. Passwords are bcrypt hashed. Archives are encrypted by Borg itself. Agent traffic is HTTPS; backup traffic is SSH.
- No shell for agents. Agents cannot run arbitrary commands, are confined to their own directory, and have no access to other clients' data.
- Hardened web layer. Parameterized queries, CSRF tokens with constant-time comparison, XSS escaping, HttpOnly cookies, and rate limiting on logins, 2FA attempts and API endpoints.
For automation and operations
- Agent-based architecture. Lightweight agents for Linux, macOS and Windows. Borg itself has never shipped for Windows, so I built and maintain Borg for Windows, a native binary that runs without WSL or Cygwin and backs up and restores NTFS ACLs.
- Policy-based plans. Reusable backup templates with paths, excludes, compression and retention. Cron-style scheduling from hourly to monthly, multiple schedules per machine, each with its own retention. Hourly, daily, weekly, monthly and yearly keep rules with automatic pruning.
- Queue and fleet control. Concurrency limits, priority ordering, cancel and retry, and centralized agent and Borg version upgrades pushed from the console with automatic validation and rollback.
- Plugin system. Pre- and post-backup hooks with built-in plugins for MySQL, PostgreSQL and MongoDB, shell-script hooks for everything else, and custom plugins defined in a few lines of JSON. One-click database restore from any archive.
- Offsite replication and DR. Repositories mirror automatically to S3-compatible storage after each prune: AWS S3, Wasabi, Backblaze B2, DigitalOcean Spaces, Cloudflare R2, MinIO, with storage classes down to Glacier Deep Archive. The server backs up its own database, config and keys to S3, restores repositories straight from S3, and a manifest system makes the file catalog available instantly after a restore.
- Alerting. Daily email summaries plus Apprise notifications to 100+ services (Slack, Teams, Discord, PagerDuty, SMS and more) on failures, missed schedules and critical events.
- Deploy anywhere. Docker, bare metal, VM or LXC. Repository maintenance (unlock, check, repair, re-catalog) runs from the UI.
For developers and the people who use the interface
- One dashboard. Every machine, recent backups, failures, storage use and server health in a single view, with backup charts and a live log feed.
- Real time. Live progress bars and streaming logs for every backup and restore job.
- Restore without the command line. A hierarchical, lazy-loading file browser, global search across archives backed by ClickHouse, and restores to the original location, an alternate directory, or a tar.gz download.
- API driven. A REST API behind everything the console does, which is what the iOS app is built on.
BBS Manager: the companion app
I designed and built BBS Manager in React Native as the paid companion to the free platform. The iPhone and iPad app uses the same REST API as the web console for client health, queues, backup controls and settings. Real-time push notifications for failures, warnings and completions deep-link straight to the job. The app proved that BBS was not just a web interface. It was an API-driven platform ready for more than one client.
Learn more about Borg Backup Server and the iOS app, BBS Manager.
