3-2-1 has been the gold standard for data protection for decades. Most people have the first two copies. The third - offsite - is the one that saves you when the building burns down. This page explains the rule and shows you how to implement it with restic.
RAID is not backup. A second disk in the same machine is not offsite. A NAS in the same building is not offsite. Cloud sync (Dropbox, Google Drive) is not quite the same as backup - sync propagates deletions and ransomware encryption to the remote copy.
Real offsite backup means: immutable snapshots, physically separate location, encrypted with a key you control.
# Set up credentials
sudo tee /etc/restic/env <<EOF
RESTIC_REPOSITORY=sftp:vaultuser@vault.servercrate.net:22150:/data
RESTIC_PASSWORD=your-strong-password
EOF
sudo chmod 600 /etc/restic/env
source /etc/restic/env
restic init
# First offsite backup
restic backup /home /etc /var/www \
--tag offsite \
--exclude="*/cache" \
--exclude="*/tmp"
# Verify it worked
restic snapshotsA backup you have never tested is not a backup, it is a hope. Schedule a restore drill every 90 days. Restore a random file and verify it opens correctly. Restore a full directory to a temp location and check it. This takes 15 minutes and is worth more than any monitoring dashboard.
# Test restore of a specific file
restic restore latest \
--target /tmp/restore-test \
--include /etc/nginx/nginx.conf
cat /tmp/restore-test/etc/nginx/nginx.confSome people recommend 3-2-1-1-0: an additional immutable copy (1) with zero errors verified (0). Restic's restic check command handles the zero-errors verification. An append-only remote repository handles immutability - once written, old snapshots cannot be deleted even if an attacker gains access to your backup credentials.
The original 3-2-1 rule predates ransomware as a mainstream threat. Modern variants add a fourth requirement: at least one copy must be immutable or append-only, so ransomware that encrypts your primary data and local backup cannot also destroy the offsite copy.
Restic with ServerCrate provides strong isolation for the offsite copy - the vault is only writable via SFTP with your credentials, not mounted as a network drive or accessible via SMB. An attacker who compromises your primary machine cannot reach the vault without your SFTP credentials. This makes it a practical ransomware-resilient offsite component for most homelab and small business setups.
Having three copies means nothing if none of them are actually restorable. Schedule a restore test monthly: pick a random file from your most recent snapshot and restore it. Quarterly, do a full directory restore to a temporary location. The restic restore guide has copy-paste commands for every scenario. ServerCrate has no egress fees so testing costs you nothing beyond a few minutes of time.
After a decade of people trying to follow the 3-2-1 rule, several patterns of self-deception have emerged. Avoid these traps:
If you had to pick only one of the three copies to keep, it would be the offsite one. A single offsite encrypted backup beats a perfect local 3-2-0 setup because the threats that kill local backups - fire, flood, theft, ransomware that spreads laterally across the LAN - tend to kill them all at once. The offsite copy is the one that survives the bad day.
That's why ServerCrate is designed as an offsite-only service. We're not trying to replace your primary storage or your local NAS. We're the third copy that's sitting in a different building, on different hardware, behind an SFTP endpoint your primary network doesn't have credentials to without the RESTIC_PASSWORD on disk.
Not everyone needs enterprise-grade backup infrastructure. Here are minimum setups that actually satisfy 3-2-1 for different scales:
The offsite piece. Free tier, no card required.
Cancel anytime. 10 GB free tier never expires. No egress fees.
10 GB. No credit card. Setup in 5 minutes. Bitcoin or card when you upgrade.
Start free vault →