Backing up my Android phone with Termux and BorgBackup

You can use a mainstream file-synchronisation and cloud-backup service, such as Google Drive, Google Photos, Dropbox, and the like. These services tend to be easy to use and, all considered, cost-effective. However, they are typically proprietary and not end-to-end encrypted. By using them, you end up relinquishing some degree of control over your data.

You can use one of the popular open-source self-hostable solutions such as Nextcloud, Syncthing, or Immich. These are all great projects with a good track record. However, none of them seemed to quite fit my needs.

The third and ultimate solution I could think of was a bespoke combination of Termux and BorgBackup. It seemed the most promising option for my case, so that's what I went for.

In the rest of this post, I go through the setup in more detail.

Install Termux from F-Droid or Google Play. Then, within Termux:

pkg install \
    borgbackup \
    curl \
    jq \
    openssh \
    termux-api \
    termux-tools

Create an SSH key pair:

ssh-keygen -t ed25519 -f ~/.ssh/id_ed25519 -N ""

Copy the public part of the key to your server's ~/.ssh/authorized_keys so that you can log in without being prompted for a password. Let's assume that your server is server.example.com and that you can log into it with ssh phone@server.example.com.

BorgBackup, or simply Borg, is a great Python tool for deduplicated (i.e. space-efficient) encrypted backups. Some familiarity with Borg is taken for granted here. Refer to the project's documentation if you're new to it.

Initialise the Borg repository:

borg init --encryption=repokey ssh://phone@server.example.com/path/to/repo

If you trust the server, you may want to use an empty passphrase, which makes it easier to use Borg non-interactively.

Congratulations, you should now be able to back up your files with:

borg create ssh://phone@server.example.com/path/to/repo::first-backup \
    /storage/emulated/0/data-0 \
    /storage/emulated/0/data-1 \
    ...

Did it work? Yay, congratulations!

The command is quite a mouthful, though, isn't it? Custom Bash script to the rescue then - read on.

I use a backup script to make invocations a bit easier - see the end of this blog post for the full listing. I have the script saved as ~/.local/bin/backup (which is in my shell's PATH).

Save the script configuration in ~/.config/backup.json:

{
  "source_directories": [
    "/storage/emulated/0/data-0",
    "/storage/emulated/0/data-1",
    ...
  ],
  "repository": "ssh://phone@server.example.com/path/to/repo"
}

Optionally, include exclude_patterns (for paths that you do not want to back up) and healthcheck_url (for health-check services to ping when the script completes successfully). Refer to the script source for further details.

Now test the script by running backup or backup my-config.json. This should create a new backup on the server, with the folders data-0, data-1, etc.

If all has worked well so far, you may want to schedule the backup to run automatically at regular intervals. The termux-api package we installed earlier provides the termux-job-scheduler command, which is the Termux equivalent of a cron job:

termux-job-scheduler \
    --battery-not-low false \
    --network unmetered \
    --period-ms 900000 \
    --persisted true \
    --script ~/.local/bin/backup

In my experience, this doesn't seem to drain the battery noticeably, but your mileage may vary. If so, tweak the job options accordingly (e.g. --battery-not-low and --period-ms). You can see the list of current jobs with termux-job-scheduler --pending.

WireGuard is a lightweight VPN protocol that creates encrypted point-to-point tunnels with minimal configuration and great performance. My phone-to-server connection runs over a WireGuard tunnel: the server only exposes SSH on the WireGuard interface, meaning it is not reachable from the public internet. The WireGuard Android app makes it straightforward to keep the tunnel active on the phone.

Earlier, we copied the phone's public key to the server's ~/.ssh/authorized_keys to allow password-less logins. We can restrict the phone user's SSH access so that it can only run Borg by prepending the following to the public key entry:

command="borg serve --restrict-to-path /home/phone/backup",restrict ssh-...

You may want to check the OpenSSH documentation for further details, e.g. here.

Things can be made even more restrictive - for example, by setting the Borg repository to append-only mode. This would prevent an attacker from getting hold of your phone and remotely deleting all your backups - although it's not really part of my threat model.