Three copies, two media, one off-site
The 3-2-1 rule remains the best summary of forty years of IT disasters: at least 3 copies of your data, on 2 different media, with 1 off-site. Let's apply it to a VPS, concretely.
Layer 1: hypervisor snapshots
Our plans include daily snapshots retained for 7 days. That's your immediate safety net: full restoration in minutes from the customer panel. But a hypervisor snapshot has two limits: it lives in the same infrastructure as your VPS, and it captures a disk state, not necessarily a consistent database state.
Layer 2: application-level dumps
The only reliable database backup is an application-level export, taken hot:
# daily cron, 3:15 AM: compressed, timestamped PostgreSQL dump
15 3 * * * pg_dump -Fc -f /var/backups/app-$(date +%F).dump appAdd application files (uploads, configuration) with restic or borg, which deduplicate and encrypt.
Layer 3: the off-site copy
The copy that will save you the day everything else burns must not depend on any component of the primary site. Two serious options:
- A second VPS in another datacenter (Paris → Frankfurt: 12 ms latency, nightly replication with no impact)
- Object storage, with client-side encryption:
restic -r s3:https://s3.example.com/backups backup /var/backupsAlways encrypt before exporting: the remote copy is the one you control least.
The restore test, the step 80% of people skip
An untested backup is a hypothesis, not a backup. Our protocol, applied to our own systems:
1. Every month, restore a copy onto a throwaway VPS (deployed in 55 seconds, deleted afterwards) 2. Check that the application starts and that recent data is present 3. Time it: that's your real RTO, not your theoretical one
Internally, roughly one test in twelve uncovers a problem — broken cron, full disk, changed permissions. Better to find out this way.
Define your RPO before your tool
How much data can you afford to lose? An hour of e-commerce orders is unacceptable; a day of blog posts, tolerable. RPO dictates frequency: hourly dumps for the shop, daily for the blog. Everything else is just plumbing.