Backup & recovery

The 3-2-1 rule, exceeded: four copies, two media, two offsite.

4 copies · 2 media · 2 offsite · RPO ≤ 24h · RTO hours (local) / days (offsite)

How the chain works — NAS 1 pushes out, never pulls

NAS 1 is the only writer. Every night it pushes encrypted, deduplicated restic snapshots to the other three units. The copies never push back — restore happens on demand, one direction only.

  1. Nightly cron on NAS 1: pg_dump the Immich database first — files and DB must land in the same snapshot.
  2. restic backup → NAS 2 over the LAN (minutes). This is the fast-restore copy.
  3. restic backup → NAS 3 over the site mesh (small daily delta). This is the disaster copy.
  4. Brother’s box: restic copy NAS 3 → NAS 4 over his LAN — zero Istanbul upload bandwidth.
  5. Healthcheck pings each job; any failure alerts immediately. An unmonitored backup is a hope.
1

NAS 1 · ACTIVE

Istanbul

local
backup: Primary data source — pushes nightly restic to NAS 2 + NAS 3.
failure: Disk failure / hardware death → restore from NAS 2.
2

NAS 2 · PASSIVE

Istanbul

local
backup: Local backup — nightly restic over LAN.
failure: Dead disk → replace + re-sync from NAS 1.
3

NAS 3 · PASSIVE

Tallinn

offsite
backup: Offsite #1 — nightly restic over the site mesh.
failure: Dead disk → replace + re-sync.
4

NAS 4 · PASSIVE

Tallinn

offsite
backup: Offsite #2 — restic copy from NAS 3 on brother’s LAN.
failure: Dead disk → re-copy from NAS 3 (LAN).

A backup never restored is a hope — quarterly restore drills.