Vaultwitness: automatic restore tests and repository checks for Borg (self-hosted)

[Salter-pol]

Hi all,

Disclosure first: I'm the author of the tool below.

I got tired of checking my backups by hand. The worst part was a backup that simply wasn't made: no error, no message, nothing — you only find out when you go looking for it. A finished borg create only tells you data was written, not that you can get it back. Checking that by hand for every repository takes time, and it's easy to skip.

So I built a tool that does it for me, and I'd like feedback from people who know Borg well.

It doesn't run your backups — it watches the Borg setup you already have and tells you whether those backups would actually restore. Per repository:

• Restore test — reads a real file out of the newest archive with borg extract --stdout, in full. Nothing is written to disk.
• Integrity — borg check on each deep check, and the full borg check --verify-data once every N checks, so every byte is re-read within the period you choose.
• Late backups — learns each repository's rhythm and warns when an archive is overdue.
• Failed jobs — finds the cron job, systemd unit or borgmatic timer, reads its log and explains Borg's errors in plain words: lock timeouts, a wrong passphrase, a missing repository, ssh failures.
• Housekeeping — notices when no old archive was pruned for weeks; warns when many archives disappear at once (a wrong prune rule, or someone deleting backups).
• Content — reads database dumps back from the archive and flags ones that shrank; checks paths you mark as required.
• Alerts by email, Telegram or webhook, and a printable report of the checks.

No config to write. The agent finds repositories by itself: cron entries and systemd services that run borg create or set BORG_REPO (with BORG_PASSCOMMAND / BORG_PASSPHRASE and BORG_RSH), and borgmatic configs in both layouts. Anything it can't see can be listed by hand. Passphrases never leave the machine.

Careful with your repositories. The agent only reads. It lists archives without waiting for a running backup, never breaks a lock, and runs at low CPU and disk priority, one check at a time. It works with Borg 1.2 and 1.4, and with restic in the same dashboard.

The dashboard server is something you host yourself (Linux x86-64). No cloud account, no telemetry, it works with no internet at all.

Pricing, plainly: free for 2 servers, forever — no sign-up. Everything is unlocked for 14 days on any number of servers. The agent is open source (Apache 2.0), so you can read exactly what runs as root on your machines; the dashboard is closed source.

https://vaultwitness.com/borg

I also wrote up how to do a restore test by hand with plain Borg: https://vaultwitness.com/guides/borg-restore-test

Feedback very welcome, especially on the checks: is there a way a Borg backup has failed you that this wouldn't catch?