I stopped believing in my backups the day I realized I had never restored one. Deduplication and encryption are nice, but the only backup that survived a real loss was the one I had practiced restoring. This is the setup I trust and the habit that protects it.
borg for local, restic for the remote
borg is excellent for snapshotting locally — dedup, compression, encryption. restic is friendlier for pushing to object storage and its content-addressed store is easy to verify. Using both is not overkill if their strengths cover different targets.
restic backup /data /home --exclude-caches
restic forget --keep-daily 7 --keep-weekly 4 --prune
restic check --read-checksThe 3-2-1 that is not just a slogan
Three copies, two media, one offsite. The offsite copy is the one people skip, and it is the only one that matters when the box burns. Encrypt it twice — once at rest on the source, once on the remote — so a leaked key does not hand over everything.
Test restores, quarterly
restic restore latest -t /tmp/restore-test
# compare a known file:
diff /data/known.txt /tmp/restore-test/known.txtRestore a random file and, occasionally, do a full restore onto a spare box. The errors you find in practice are cheap; the ones you find during a real incident are expensive.
A backup you have not tested is a wish with better branding.