You need backups before the panic sets in
You just ran dnf upgrade and the system drops to an emergency shell. Or you moved ~/.ssh to the trash and realized you can't push to GitHub. The panic is real. Fedora includes Deja Dup, but the default configuration often misses the mark. This guide covers how to set up backups that survive disk failure, accidental deletion, and botched upgrades.
How Deja Dup works under the hood
Deja Dup is a frontend for duplicity. It uses GnuPG for encryption and rsync algorithms for incremental transfers. The first run creates a full backup. Subsequent runs store only the changes. This keeps storage usage low. Encryption is mandatory. The tool generates a GPG key pair or uses your login keyring. If you lose the encryption key, the backup is useless.
The backup data lives in ~/.local/share/deja-dup for cache and metadata. The actual encrypted volumes go to your chosen destination. The volumes look like duplicity-full.20240101.gz.gpg. Do not delete these files manually. The chain relies on the full backup and every incremental since. Breaking the chain makes the entire backup set unrecoverable.
Convention aside: Deja Dup respects XDG base directories. It automatically includes ~/.config, ~/.local, and ~/.cache in its scope, but excludes large cache files by default. It also backs up your home directory structure. If you store data in /srv or /var/www, those paths are not included unless you add them explicitly.
Encryption protects your data from theft. It also protects your data from you if you forget the passphrase. Write the passphrase down and store it offline.
Configuring storage and encryption
Open the Settings application and navigate to Backups. Toggle the switch to On. The system schedules daily backups. Click Storage to choose a destination.
Local folders are convenient but risky. If the disk controller fails, the backup dies with the system. External drives require manual mounting. Cloud storage via WebDAV or Nextcloud provides off-site protection. Use cloud storage when you want redundancy against physical loss.
Click Options to review exclusions. The defaults skip ~/.cache, ~/.local/share/Trash, and /tmp. Add ~/.mozilla/firefox/*/cache2 if you want to save space. Do not exclude ~/.gnupg or ~/.ssh. Those directories contain keys you cannot regenerate.
Set the retention policy in Options. Keep daily backups for seven days and weekly backups for four weeks. This balances storage usage with recovery points. Older backups are deleted automatically when new ones run.
Using the command line for control
The GUI is sufficient for daily use. The command line helps when automation fails or the system is broken. The deja-dup command exposes the same engine.
Here's how to check the current backup status and see errors that the GUI might hide.
deja-dup --monitor
# WHY: Shows real-time progress and error messages.
# Useful when the GUI spinner hangs without explanation.
# Press Ctrl+C to stop monitoring.
Here's how to force an immediate backup run.
deja-dup --backup
# WHY: Triggers a backup immediately.
# Bypasses the scheduled timer.
# Good for testing configuration before relying on automation.
Here's how to verify the backup chain is intact.
deja-dup --check
# WHY: Runs a dry-run restore simulation.
# Validates the integrity of the backup volumes.
# Catches corruption before you need the data.
Convention aside: deja-dup uses duplicity under the hood. You can pass options to duplicity via environment variables if you need advanced tuning. Most users never need this. The CLI flags cover 99% of use cases.
Run deja-dup --check after every major system change. Corruption goes unnoticed until restore time.
Restoring from a broken system
If Fedora won't boot, you cannot run Deja Dup from the desktop. Boot the Fedora Live USB. Install deja-dup via dnf. Mount your root partition. Run the restore command pointing to the backup location.
Here's how to restore files when the OS is unbootable.
sudo dnf install deja-dup
# WHY: Installs the backup tool on the live environment.
# The live ISO usually includes it, but verify.
sudo mount /dev/nvme0n1p2 /mnt
# WHY: Mounts the broken system's root partition.
# Replace device path with your actual root partition.
# Use lsblk to find the correct device.
deja-dup --restore --target /mnt
# WHY: Restores files to the mounted partition.
# Allows recovery even when the OS is unbootable.
# Select the backup date from the list.
The restore process overwrites files in the target directory. Ensure you select the correct backup date. Restoring an old backup might revert system changes you want to keep.
If you only need a single file, use the --restore flag with a path.
deja-dup --restore /home/user/Documents/important.txt
# WHY: Restores a specific file to its original location.
# Useful for quick recovery without full system restore.
# The tool prompts for the destination if the file exists.
Test the restore process monthly. A backup you haven't restored is just a hope.
Common errors and pitfalls
GPG errors are common after system resets or keyring changes. The error gpg: decryption failed: No secret key means the keyring is missing or corrupted. Check ~/.gnupg permissions. Ensure the key is imported.
gpg: decryption failed: No secret key
Fix this by importing the key from your backup or resetting the passphrase in the GUI. If you changed your login password, the keyring might be locked. Unlock the keyring in the Settings application.
External drive errors appear when the drive is not mounted. The error Error: Storage target is not available stops the backup. Mount the drive before running the backup. Use udisks2 or automount to handle this automatically.
Error: Storage target is not available
Space issues arise when backups accumulate. The retention policy handles this. If you disabled retention, old backups pile up. Check the storage usage in the GUI. Delete old backups via the GUI, not the file manager. Manual deletion breaks the chain.
Cloud storage timeouts happen with slow connections. The backup might fail partway through. Deja Dup retries automatically. If it fails repeatedly, check your network. Use deja-dup --monitor to see the transfer speed.
Check journalctl -xeu deja-dup for detailed logs when the GUI gives no clues. The journal contains the actual error from duplicity.
Choosing the right backup tool
Use Deja Dup when you want a set-and-forget backup solution integrated into GNOME. Use rsync with a cron job when you need granular control over file permissions and incremental syncs to a local server. Use borg or restic when you require deduplication across multiple machines and advanced compression. Use timeshift when you need system-level snapshots for rolling back kernel updates or package changes. Use cloud-native tools like rclone when your primary storage is S3 or B2 and you want direct API access.
Verify the restore works before you trust the backup. Future-you will thank present-you.