Backups: applying the 3-2-1 rule without getting lost

The 3-2-1 rule fits in one sentence and prevents most data loss. Yet most backups fail on one point: they are never tested.

• 3 copies, on 2 different media, including 1 off-site.
• A snapshot on the same disk as production does not count as a copy.
• Automate every backup and get alerted on failure.
• Test a full restore every month and measure how long it takes.
• Encrypt backups and make the off-site copy immutable.

The rule in one sentence

Keep 3 copies of your data, on 2 different types of media, with 1 copy off-site. A snapshot on the same disk as production doesn't count as a real copy: a fire, ransomware or a simple rm -rf mistake takes it along with everything else.

• 3 copies: production + local backup + remote backup.
• 2 media: VPS disk + object storage or NAS, for example.
• 1 off-site: another region, another provider, another building.

Automate, or it doesn't exist

A manual backup is a forgotten backup. Automatic VPS snapshots, database dumps via cron, sync to object storage: everything must run without human intervention, with an alert on failure.

• Schedule VPS snapshots + SQL dumps with automated jobs.
• Alert (email/webhook) as soon as a backup fails.
• Version your backups: keep at least 7 rolling days.
• Game server: see how to secure a Minecraft server, backups included.

Really test your restore

An untested backup is just a hypothesis. Once a month, restore to an isolated environment: does a SQL dump re-import? Does the snapshot boot? How long does the full restore take? That's the only number that matters on the day of an incident.

• Restore to a test server once a month.
• Measure your RTO (restore time) and RPO (maximum data loss).
• Document the procedure so that a third party can run it.

Encrypt and control access

Your backups contain everything: passwords, customer data, source code. Encrypt them at rest, limit who can read or delete them, and enable deletion protection (object lock / immutability) on the off-site copy. To keep your data on a dedicated Linux server, see the ACLClouds VPS plans.

• Encrypt backups, in transit and at rest.
• Restrict deletion rights (principle of least privilege).
• Enable immutability on the off-site copy against ransomware.