The 3-2-1 Rule
The foundation of any backup strategy:
- 3 copies of your data
- 2 different storage media
- 1 copy offsite
This protects against hardware failure, ransomware, fire, theft, and most disasters.
Types of Backups
Full backup: Complete copy of everything. Large but simple to restore.
Incremental backup: Only changes since last backup. Fast and small, but restore requires all increments.
Snapshot: Point-in-time copy. Great for quick recovery, but not a replacement for offsite backups.
What to Back Up
- Databases: Choose a consistent backup method and point-in-time recovery where needed
- Configuration: Version-control settings with secrets and personal data removed
- Secrets: Use separate protected storage and document recovery access; do not commit them to source code
- User data: Agree coverage, retention and recovery requirements
- Application state: Identify external dependencies and recovery order
Also document data that the backup does not cover.
Backup Tools
For files: restic or borg - deduplicated, encrypted backups.
For databases: Native tools (pg_dump, mysqldump) plus WAL archiving.
For VMs: Proxmox Backup Server, Veeam, or snapshot-based solutions.
For cloud: Built-in snapshots plus offsite copies.
Testing Your Backups
Test regularly - monthly at minimum:
- Pick a random backup
- Restore it to a test environment
- Verify the data is complete and correct
- Document the restore time
If you haven't tested a restore, assume your backups are broken.
Ransomware Protection
Ransomware targets backups. Protect them:
- Immutable backups: Cannot be modified or deleted
- Air-gapped copies: Physically disconnected storage
- Separate credentials: Backup system has its own auth
- Delayed deletion: Retention policies that outlast attacks