Server Backup Strategy
Replaces: No backups, untested backups, single-copy data
Establish a 3-2-1 backup strategy with encrypted offsite copies before self-hosting any sensitive data.
data-breachagency-lossinfrastructure-dependency
Phase
First Self-Hosting — needs server/hardware, 2-4h
General
Before self-hosting sensitive data, establish a backup strategy:
1. 3-2-1 principle: 3 copies of data, 2 different media, 1 offsite
2. Docker volumes: schedule periodic backups with a cron script (stop container, copy volume, restart)
3. Test restores: a backup you haven't restored is just a guess — verify quarterly
4. Offsite: push encrypted backups to cloud storage (BorgBase, Backblaze B2, or rsync to a remote server)
5. Rotation: keep daily (7), weekly (4), monthly (3) snapshots — don't overwrite all copies
6. Encryption: encrypt backups before they leave the server — the offsite target should never see plaintext
For a single-server setup (repurposed laptop): Docker volume backups to an external drive + encrypted offsite to cloud storage. Weekly cron + monthly test restore.
1. 3-2-1 principle: 3 copies of data, 2 different media, 1 offsite
2. Docker volumes: schedule periodic backups with a cron script (stop container, copy volume, restart)
3. Test restores: a backup you haven't restored is just a guess — verify quarterly
4. Offsite: push encrypted backups to cloud storage (BorgBase, Backblaze B2, or rsync to a remote server)
5. Rotation: keep daily (7), weekly (4), monthly (3) snapshots — don't overwrite all copies
6. Encryption: encrypt backups before they leave the server — the offsite target should never see plaintext
For a single-server setup (repurposed laptop): Docker volume backups to an external drive + encrypted offsite to cloud storage. Weekly cron + monthly test restore.
Deployment
Self-Hosted
BorgBackup (deduplicating, encrypted, FOSS) + cron
Alternatives: Restic (simpler, cloud-native), Duplicati (web UI)
Prerequisites
Need server access set up first.