Self-hosting means my photos, files and passwords live on my own hardware, which also means I’m responsible for not losing them. Here’s how my backups work today, the weak spot I’ve found, and the plan for my new 10 TB drive.
The 3-2-1 rule
The classic rule for backups that actually save you:
- 3 copies of your data (the original plus two backups)
- on 2 different devices or types of media
- with 1 copy kept off-site
Each part protects against something different: a failed disk, a corrupted backup, or a fire or burglary that takes out everything in one place.
Where things stand today
- Immich photos: backed up to an 8 TB external drive.
- This blog: backed up nightly to the same drive (database plus site files, 14 days kept).
- PCs and the Raspberry Pi: backed up daily to the same drive by UrBackup.
- Vaultwarden: backed up nightly to a separate machine on my network, a Raspberry Pi, and to the 8 TB drive, with 30 days kept. Each backup is a consistent database snapshot that’s checked for corruption before it’s saved.
- Nextcloud files: live on the 8 TB drive, and that’s currently their only copy.
- Docker compose files: on the server’s system disk, without a separate copy yet.
The weak spots
The 8 TB drive was bought second-hand and arrived with some remapped sectors. A full surface scan found no new bad sectors developing, and Scrutiny now tracks its health every day, but it’s still a used drive carrying a lot of responsibility.
More importantly, almost all of the backups sit in or next to the same box as the originals. A disk failure is covered, but a power surge, fire, theft or mistyped command could take out the originals and the backups together. The password vault is the exception, because its backups also go to the Pi. Everything else needs a copy that lives somewhere else. That’s what the new drive is for.
The plan for the 10 TB drive
- Copy 3: a new 10 TB drive gets a full copy of everything important, refreshed regularly.
- Off-site: between updates, the drive lives away from the house, ideally with family. It’s unplugged, so ransomware or a bad command can’t reach it.
- Encrypted: an off-site drive can be lost or stolen, so the backup on it should be encrypted.
Tools I’m considering
- rsync: simple and reliable. It mirrors folders exactly, but a mirror also copies mistakes, such as deleted files.
- restic: encrypted, deduplicated snapshots. You can go back to any earlier version, and it only stores the changes, so many snapshots fit on one drive. This is my likely pick.
Most important Whatever the tool, the most important step is testing a restore. I’ll regularly restore a few photos, a Nextcloud folder and the blog from the backup drive, and check they work.
What I’ll include
- The Immich photo library and its database dumps
- Nextcloud data
- The Vaultwarden data folder
- WordPress backups
- All Docker compose files and configs in
/opt/stacks - The UrBackup store with the PC and Pi backups
I’ll write a follow-up once it’s up and running, with the exact commands.
Leave a Reply