The 3-2-1 Backup Rule Explained for Self-Hosted Businesses

Every backup guide mentions the 3-2-1 rule. Few explain how to actually do it with self-hosted tools. Here is the rule, why it works, and exactly how to implement it for your business.

The Rule

• Three copies of your data: the original plus two backups.
• Two different media types: not two hard drives in the same server. Different physical devices or different storage technologies.
• One copy offsite: geographically separated from your primary location. If a fire, flood, or theft destroys your office, the offsite backup survives.

The reasoning is straightforward. If one backup fails (and backups do fail, regularly), you have another. If both local copies are destroyed, the offsite copy survives. The two media types protect against a single point of failure: two identical drives bought at the same time from the same batch have correlated failure rates. If one fails, the other is statistically more likely to fail soon after.

Implementing 3-2-1 with Open-Source Tools

Copy 1: Live Data (Your Server)

This is your production data. Docker volumes, databases, and application files. This is not a backup. It is the source of truth.

Copy 2: Local Backup (Different Media)

Use Kopia or Restic to create encrypted, deduplicated snapshots of your Docker volumes and databases. Store these on a separate device: a NAS (Synology, QNAP, or a self-built TrueNAS box), an external USB drive, or a second server. This backup runs nightly and keeps snapshots for 30 days.

Kopia is recommended because it supports a GUI, compression, encryption, and multiple storage backends. Point it at your Docker volumes directory and your database dump directory, set a schedule, and it handles the rest.

Copy 3: Offsite Backup (Different Location)

This is the copy that survives a disaster. Options from simplest to most sophisticated:

• RustFS (S3-compatible) on a remote VPS: Deploy a RustFS instance on a VPS in a different region or country. Kopia or Restic pushes encrypted snapshots to it. This is the most self-hosted option and gives you full control.
• Backblaze B2: The cheapest object storage for backups. 6 US dollars per terabyte per month. Kopia and Restic both support B2 natively. Data is encrypted before it leaves your server.
• Hetzner Storage Box: If you already use Hetzner for hosting, their Storage Box product offers 1TB for about 4 euros per month. Accessible via SSH, Samba, or WebDAV.

Testing Your Backups

A backup that has not been tested is not a backup. It is a wish. Every quarter, perform a full restoration drill:

1. Spin up a temporary server or use a staging environment.
2. Restore your latest backup using the same tool you use for production restores.
3. Verify that applications start, databases are consistent, and files are intact.
4. Document how long the restore took and any issues encountered. Use this to update your recovery time objective.

If this process takes more than an hour, your backup strategy needs improvement. The goal is to be able to restore your entire stack within your acceptable downtime window, which for most small businesses is four to eight hours.

What Most People Get Wrong

• Backing up only the database, not the files. Your CRM database is useless without the uploaded attachments. Your Nextcloud database is useless without the actual files. Back up both.
• Storing backups on the same server. If the server fails, both the primary data and the backup are gone. The backup must be on different hardware.
• Never testing restores. You will discover that your backup script has been failing silently for six months. Test restores quarterly, without exception.

VPS1 configures 3-2-1 backups for every managed server. We also run quarterly restore drills so you know your backups actually work.