Full operating-system tar backup of a Linux server

A simple bare-bones backup: one compressed tarball of the whole root filesystem, minus the folders that are virtual, temporary or backed up separately. 
 Exclude list 
 /etc/backup.exclude : 
 /proc/*
/sys/*
/dev/*
/run/*
/tmp/*
/var/tmp/*
/usr/tmp/*
/mnt/*
/media/*
/lost+found
/var/cache/*
/swapfile
 
 Keep /etc/fstab in the backup; you will want it for a restore. 
 The backup 
 #!/bin/bash
set -euo pipefail
umask 077 # the archive contains /etc/shadow and keys
dst=/mnt/backup/$(hostname -s)/system
mountpoint -q /mnt/backup
mkdir -p "$dst"
nice -n 19 tar --one-file-system -cpjf "$dst/$(date +%F).system.tar.bz2" \
 --exclude-from=/etc/backup.exclude -C / .
find "$dst" -type f -name '*.tar.bz2' -mtime +3 -delete
 
 
 Use --one-file-system to stay on the root filesystem. In modern GNU tar, -l means --check-links , not "one filesystem". 
 
 umask 077 matters. The archive holds password hashes, SSH host keys and database credential files, so it must not be readable by everyone on the NAS share. 
 
 zstd ( tar -I zstd ) is much faster than bzip2 if it is available. 
 
 Schedule 
 0 0 * * 0 root /usr/local/bin/backup_system.sh >/dev/null 2>&1
 
 Restore 
 Boot a rescue system, mount the new root at /mnt/sysimage , then run tar -xpjf <archive> -C /mnt/sysimage . Reinstall the boot loader, and fix /etc/fstab UUIDs if the disks changed.