TL;DR
- 3–2–1 rule: 3 copies, 2 media types, 1 offsite
- Daily incremental + weekly full
- Test restores monthly; automate checksum verification
Minimal FOSS Stack
- BorgBackup or Restic for deduped encrypted backups
- Rclone for pushing to offsite object storage (Wasabi, Backblaze B2)
- Health checks via Healthchecks.io (self-hosted OK)
# example: restic + rclone remote
export RESTIC_PASSWORD=change-me
restic -r rclone:wasabi:org-backups init
restic -r rclone:wasabi:org-backups backup /srv/data /etc
restic -r rclone:wasabi:org-backups forget --keep-daily 7 --keep-weekly 4 --prune
Restore Drills
- Spin up a throwaway VM
- Pull snapshot, verify sha256
- Document timing + gaps; fix exclusions
Backups aren’t real until you’ve restored them.