Keep 3 copies of your data, on 2 different kinds of storage, with 1 copy off-site. Here's what that actually looks like on one small server.
The 3-2-1 rule gets quoted constantly and implemented rarely, usually because it sounds like enterprise policy. It isn't. For a single self-hosted VPS, the whole thing fits in an afternoon.
Copy by copy
- Copy 1 — the live data. Your apps and their Docker volumes, running on the server. This is the working copy, and it's also the one most likely to be damaged by a bad update or a mistyped command.
- Copy 2 — daily, off the server. An automated job (Restic is the popular choice) pushes encrypted, incremental backups to object storage from a different provider. Incremental means only changes upload, so daily is cheap. Encrypted means the storage provider can't read your data.
- Copy 3 — weekly, somewhere you control. A pull to your home computer or a NAS. This is your insurance against the worst case: losing access to your cloud accounts entirely.
Notice the "different provider" and "somewhere you control" parts — that's the actual point of the rule. Any single failure — provider outage, account compromise, a house problem — can only ever take out part of the picture.
What makes it maintainable
- Automate everything. Backups that require you to remember them eventually don't happen. Cron plus a monitoring alert on failure.
- Back up the setup, not just the data. Your compose files and configs are tiny and are what turn a blank server back into your server. Include them in the same job.
- Test a restore quarterly. The rule without restore tests is superstition. The full routine — including a real restore — is in the backups guide.
The bottom line
Total ongoing effort once it's built: about zero. Total value the day something goes wrong: everything. It's the least glamorous, most important system on your server — which is exactly why it should be first, not last.