Back up your data: the 3-2-1 rule in practice
Build a backup routine that survives a mistake, a failure, or a disaster.
Backups are boring until the day they are the only thing that matters. Build the habit before that day.
The 3-2-1 rule
3 copies of your data.
On 2 different types of media or systems.
With 1 copy off-site.
In practice: the live system, a fast local backup (snapshot), and an off-site copy in object storage or another host.
What to back up
Files — uploads, code, config, themes.
Databases — separately, and consistently. See Database backups.
Secrets — env files and keys, stored securely and separately (never in the same archive as the data, or the backup itself becomes the breach).
DNS records — export them; recreating from memory during an incident is miserable.
How, here
Snapshots — instant rollback for a bad change on the same host. Not a backup (they live with the server).
Panel backups — scheduled backups of a service to our backup storage.
Object storage — copy backups to a bucket for off-site durability. See Object storage basics.
Your own tooling — restic (fast, encrypted, deduplicated) is an excellent default; Duplicati offers a GUI.
Example with restic to off-site storage:
export RESTIC_REPOSITORY=s3:https://s3.example/backups
export RESTIC_PASSWORD_FILE=/etc/restic/pw
restic init
restic backup /var/www /etc --exclude-caches
restic snapshots
# keep a sane history
restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --pruneAutomate, and verify it ran
A backup that silently stopped three weeks ago is worse than none, because you are relying on it. Alert on backup success, not just on failure. See Monitoring alerts that matter.
Test the restore — non-negotiable
Restoring is the only proof. On a schedule:
Restore files to a scratch location and open one.
Restore the database to a temp instance and run a query.
Confirm the data is current, not from the day the job broke.
Encryption
Encrypt anything leaving the host. A plain-text database dump in object storage is a breach waiting to happen. restic encrypts by design; keep the passphrase somewhere you will still have it when you need it.
Related reading