This guide is intended to enable people who are not particulary comfortable with the command line to use Wyng Backup, which is much faster than the official backup tool due to its support for “deduplication”.
Set up:
Install
Start by downloading the most recent release for wyng-backup here and wyng-util-qubes here.
Verify the integrity of both of your downloads by following the instructions provided. It is best practice to verify a PGP key by comparing its fingerprint to a second source before trusting it: after importing the developer’s PGP key, run gpg -k to output its fingerprint, and make sure that it matches this forum post.
Finally, we will copy both downloads to dom0. In the dom0 terminal (Qubes menu > Other > Xfce terminal) run the following commands, replacing the path to the downloads as appropriate (depending on where your downloads are stored and what version you downloaded):
# Lines preceded by a # are a comment
# Copy wyng-backup from personal to dom0
[user@dom0 ~]$ qvm-run --pass-io personal 'cat /home/user/QubesIncoming/disp4099/wyng-backup-0.8beta6/src/wyng' > /home/user/Downloads/wyng
# Copy wyng-util-qubes from personal to dom0
[user@dom0 ~]$ qvm-run --pass-io personal 'cat /home/user/QubesIncoming/disp4099/wyng-util-qubes-0.9beta1/src/wyng-util-qubes' > /home/user/Downloads/wyng-util-qubes
# Install dependencies
[user@dom0 ~]$ sudo qubes-dom0-update python3-pycryptodomex python3-zstd
# Copy both to /usr/local/bin
[user@dom0 ~]$ sudo cp -a /home/user/Downloads/wyng /home/user/Downloads/wyng-util-qubes /usr/local/bin
# Make both executable
[user@dom0 ~]$ chmod +x /usr/local/bin/wyng*
Configure
We will now make a configuration file, as described by the docs.
# Make the directory
[user@dom0 ~]$ sudo mkdir /etc/wyng
# Write the file with vim (if you don't know vim, use nano instead)
[user@dom0 ~]$ sudo vim /etc/wyng/wyng.ini
Write the following contents to the file /etc/wyng/wyng.ini, replacing VOLUME-NAME with whatever the volume is named on the external drive you’ll be using:
[var-global-default]
dedup = 1
authmin = 10
autoprune = full
apdays = 90:7:7:1
dest = qubes://sys-usb/media/user/VOLUME-NAME/backups/laptop.backup
Extend metadata space
If you have a default Qubes OS installation, it uses a “thin-provisioned LVM” filesystem. To use Wyng safely with a default Qubes OS installation, we’ll need to triple the amount of space allocated to metadata by default, as described by the docs.
First, we need to determine what the default metadata size is. This filesystem uses two terms that you should know: the Volume Group (in our case, qubes_dom0), and the Logical Volume (in our case, vm-pool). Again, in the dom0 terminal:
[user@dom0 ~]$ sudo lvs -o+metadata_size qubes_dom0/vm-pool
This will output a value for Msize. We will use the example of 100.00m i.e. 100 megabyes. This means that we want to extend it to a total size of 300.00m.
Secondly, we need to make sure that the Volume Group has enough space for this extension:
[user@dom0 ~]$ sudo vgs
This will output a value for VFree, which should be larger than the amount of space that you want to extend by (in our example, a difference of 200 megabytes). If you need to free up space in the Volume Group before you can extend, see the instructions for taking some space from the swap logical volume.
Finally, we will do the extension:
[user@dom0 ~]$ sudo lvextend --poolmetadatasize 300.00m qubes_dom0/vm-pool
Now even during the Wyng backup, the Meta% of qubes_dom0/vm-pool shouldn’t rise about 50%.
Select qubes for backup
In Qube Manager, select all qubes that you want to be backed up by checking their “Backup” column.
Using Wyng
Plug in your external drive
Plug your external drive into the computer. Open a File Manager in the sys-usb qube, and use it to decrypt the LUKS partition of your external drive. Create a directory named backups at the root of the decrypted volume if it doesn’t already exist.
Create a fresh archive
Start by creating a fresh Wyng archive, which will prompt you for a backup password:
[user@dom0 ~]$ sudo wyng arch-init
You will see that on your external drive, a directory now exists named laptop.backup. Don’t manually alter the contents of this directory.
Backup, arch-check, monitor
Every time you do a backup, there are three important operations: prune (get rid of old unnecessary backups), make a new backup, and then verify that the backup archive isn’t corrupted.
The following command will backup every qube that was previously checked in Qube Manager. The configuration file we made earlier also prunes old backup sessions at the same time, based on the criteria we specified. For example, our choice of apdays=90:7:7:1 will cause autoprune to remove all sessions that are older than 90 days, and sessions older than 7 days will be thinned-out while preserving (roughly on average) 1 session per week. See the docs for more information.
[user@dom0 ~]$ sudo wyng-util-qubes backup --includes
After the backup is complete, check the the integrity of the archive:
[user@dom0 ~]$ sudo wyng arch-check --session=newest
Lastly, we will free disk space used by aging snapshots:
[user@dom0 ~]$ sudo wyng monitor --all
Restore
If you would like to first list what qubes are in the archive that can be restored, run:
[user@dom0 ~]$ sudo wyng-util-qubes list --all
Before restoring a qube, if you don’t want the version currently on your system to be overwritten by the restored backup, CLONE IT BEFORE RESTORING. For the example of a qube named “personal”, first clone it with the name “personal-clone-1”, then you can restore the latest backup of “personal”:
[user@dom0 ~]$ sudo wyng-util-qubes restore personal
In contast, if you have a fresh Qubes OS installation and you’d like to restore the last session in its entirety, first do the “Set up” steps above, then simply run:
[user@dom0 ~]$ sudo wyng-util-qubes restore
Optional: Script the backup/check/monitor
In dom0, use vim (or nano) to create the file ~/Documents/backup.sh, with the following contents:
#!/bin/bash
echo "Starting backup..."
sudo wyng-util-qubes backup --includes
echo "Starting check..."
sudo wyng arch-check --session=newest
echo "Starting monitor..."
sudo wyng monitor --all
Then make the file executable:
[user@dom0 ~]$ chmod +x ~/Documents/backup.sh
To backup/check/monitor, you can now simply run:
[user@dom0 ~]$ ~/Documents/backup.sh
I can only hope that this guide becomes irrelevant because Wyng gets used as the backend of the Qubes OS backup tool. Practically every Qubes OS user I know uses the backup tool far too rarely to be functional in the case of data loss, and it’s because people today expect something far faster, like the macOS time machine. So here are my two cents that the Qubes OS community deserves better than the current backup tool, and Wyng is a realistic amount of code to audit and throw a GUI in front of.