Backups with the 3-2-1 rule: rsync, restic and Syncthing

Your NAS protects your files against a broken disk, but not against a deleted file, ransomware, burglary or fire. A backup is a second copy in a different location. Here’s how to set that up affordably and reliably.

The 3-2-1 rule

3 copies of what’s important (the original plus two backups);
on 2 different types of storage (for example the NAS and an external disk);
of which 1 outside your home (at a family member’s place, or in the cloud).

Synchronization is not a backup

Programs like Syncthing keep folders synchronized across multiple devices. Convenient, but a file you delete in one place also disappears in the other. Use synchronization to access your files, and a real backup to recover them.

Option 1: rsync, a simple copy

With rsync you copy a folder to another disk or server and only changes are transferred:

rsync -avh --progress /srv/nas/ /mnt/backup/nas/

With --delete rsync also removes files that no longer exist in the source. That keeps the copy synchronized, but also propagates your mistakes. Try first with --dry-run what would happen. To another server (with SSH) is also possible:

rsync -avh /srv/nas/ user@back-upserver:/opt/backup/nas/

Option 2: restic, backups with history

restic creates encrypted, compressed backups and keeps multiple snapshots, so you can also recover an old version of a file. It can backup to a disk, another server and the cloud.

sudo apt install restic
restic init -r /mnt/backup/restic               # one-time: create the storage
restic -r /mnt/backup/restic backup /srv/nas    # create a backup
restic -r /mnt/backup/restic snapshots          # view the snapshots
restic -r /mnt/backup/restic restore latest --target /tmp/recovery

Restic asks for a password. Store that password separately, in a safe place. Without the password your backups can no longer be opened. Generate one with our password generator.

You clean up old snapshots with a retention policy, for example the last 7 days, 4 weeks and 6 months:

restic -r /mnt/backup/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

Restic also works with a server via SSH (sftp:user@server:/path) and with cloud storage like Backblaze B2 or any service that speaks S3. This way you also arrange the copy outside your home.

Run automatically

A backup you need to remember, you’ll forget. Have it run every night with cron. Put the command in crontab -e, for example every night at 02:30. How such a line works is explained in our cron guide:

30 2 * * * restic -r /mnt/backup/restic backup /srv/nas --password-file /root/.restic-password

Store the password file with read permissions for yourself only (chmod 600).

Test your backup

A backup you don’t know works, is not a backup. At least every six months restore a few files to a temporary folder and check if they’re correct. With restic you verify the storage with restic check.

What do you keep?

Everything you can’t download again: photos, documents, settings from your servers (like compose.yaml and the data from your programs) and the backups from your virtual machines. Movies you can retrieve again don’t need to be kept as strictly.