2026-07-17

Off-Site Backup for Your Homelab: The 3-2-1 Rule, Done Cheaply

A proper 3-2-1 backup strategy means three copies of your data, on two different media types, with one copy off-site — and you can implement it for under $100 using hardware you probably already have. This guide walks through exactly how I do it with a Raspberry Pi 5, an NVMe drive, and a combination of local and remote targets.

What the 3-2-1 Rule Actually Means in Practice

Most homelabbers have copy one (the live data on their server) and maybe copy two (a second drive or RAID array on the same machine). That covers hardware failure. It does not cover fire, theft, ransomware, or a bad rm -rf. The third copy, stored physically elsewhere, is the part people skip because it seems expensive or complicated. It doesn't have to be either.

Here's a realistic, cheap 3-2-1 layout:

1. Copy 1 — Live data on your primary server/NAS.
2. Copy 2 — Automated local backup to a separate drive (different media or at minimum a different device).
3. Copy 3 — Off-site: either a physical drive you rotate to another location, or encrypted backups pushed to cloud storage.

My Setup: Raspberry Pi 5 as Backup Orchestrator

My backup orchestrator is a Raspberry Pi 5 Model B Rev 1.1 with 15 GiB RAM, running Debian GNU/Linux 13 (trixie) on kernel 6.18.34+rpt-rpi-2712. The boot drive is a Fanxiang S501Q 512GB NVMe SSD mounted via the Pi's PCIe slot running at Gen 2 (the default). Real measured throughput: 453 MB/s sequential read, 438 MB/s sequential write, with 16,433 random read IOPS at 4K. The SoC idles at 49.4°C and actually measured 48.8°C after sustained load — the thermal characteristics of the Pi 5 are genuinely excellent for always-on backup duty.

These speeds matter because your backup window depends on write throughput. At 438 MB/s writes, I can dump roughly 100 GB of compressed backup data to this NVMe in under four minutes. That's fast enough to run nightly without worrying about jobs overlapping.

Copy 2: Local Backup with Restic or Borg

I use restic for all backup jobs. It handles deduplication, encryption, and incremental snapshots. Install it on Debian:

sudo apt install restic

Initialize a local repository on a USB-attached drive (your second medium):

restic -r /mnt/usb-backup init

Then back up your critical directories:

restic -r /mnt/usb-backup backup /srv/data /srv/docker

For the USB-attached drive, an M.2 SATA SSD in an external enclosure M.2 NGFF to USB 3.0 Aluminium SSD Enclosure – Portable Homelab Storage is cheap and silent. If your backups are larger or you need NVMe speeds on the external side too, a USB-C 10Gbps NVMe enclosure M.2 NVMe SSD Enclosure – USB-C 10Gbps with Magnetic Closure will let you get close to the USB 3.2 ceiling — reportedly around 900-1000 MB/s on devices that support it, though I haven't benchmarked that enclosure specifically.

Retention Policy

Don't just keep every snapshot forever. Set a sane policy:

restic -r /mnt/usb-backup forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

This keeps a week of dailies, a month of weeklies, and six months of monthlies. Adjust to your paranoia level.

Copy 3: Getting Data Off-Site

This is the part that actually protects you. Two approaches, ranked by cost:

Option A: Physical Drive Rotation (~$0/month)

Buy two identical portable SSDs. Keep one connected to your Pi for automated nightly backups. Once a week, swap it with the one stored at your office, a friend's house, or a bank safe deposit box. Low-tech, zero recurring cost, and immune to cloud provider policy changes.

A 1 TB M.2 SATA SSD in an aluminium enclosure runs about $60-80 total. Two of them, and you have a perpetual off-site rotation for under $160.

Option B: Encrypted Cloud Backup (~$0-6/month)

restic natively supports Backblaze B2 as a backend. B2 charges $6/TB/month for storage and $0.01/GB for egress. For a typical homelab with 50-100 GB of deduplicated backup data, you're looking at $0.30-$0.60/month — essentially free. Sign up at Backblaze B2.

Configure it:

export B2_ACCOUNT_ID="your-account-id"
export B2_ACCOUNT_KEY="your-account-key"
restic -r b2:your-bucket-name:homelab init
restic -r b2:your-bucket-name:homelab backup /srv/data /srv/docker

Restic encrypts everything client-side before upload. Backblaze never sees your plaintext data. This is important — don't skip the encryption or rely on the provider's encryption alone.

Option C: Remote Server

If you already rent a VPS (say from Hetzner Cloud with their cheap storage boxes, or DigitalOcean with attached block storage), you can push restic backups over SFTP:

restic -r sftp:user@remote-server:/backups/homelab init

This doubles as off-site and gives you a restore point that's network-accessible from anywhere. Hetzner's Storage Boxes are reportedly as cheap as €3.81/month for 1 TB — purpose-built for exactly this use case.

Automating Everything with Cron and Systemd

A backup you have to remember to run is a backup that won't exist when you need it. Create a systemd timer:

# /etc/systemd/system/restic-backup.service
[Unit]
Description=Restic backup

[Service]
Type=oneshot
EnvironmentFile=/etc/restic-env
ExecStart=/usr/bin/restic -r b2:your-bucket:homelab backup /srv/data /srv/docker
ExecStartPost=/usr/bin/restic -r b2:your-bucket:homelab forget --keep-daily 7 --keep-weekly 4 --keep-monthly 6 --prune

# /etc/systemd/system/restic-backup.timer
[Unit]
Description=Nightly restic backup

[Timer]
OnCalendar=*-*-* 03:00:00
Persistent=true

[Install]
WantedBy=timers.target

Enable it:

sudo systemctl enable --now restic-backup.timer

Test Your Restores

This deserves its own section because it's the step everyone skips. A backup you've never restored from is a hypothesis, not a backup. Once a month:

restic -r b2:your-bucket:homelab restore latest --target /tmp/restore-test
diff -r /srv/data /tmp/restore-test/srv/data

If the diff shows nothing, your backups work. If it doesn't, you found out now instead of during an emergency.

Who Should NOT Do This

• If you have more than ~2 TB of data changing frequently, a Pi-based solution will bottleneck on USB and network throughput. You need a proper NAS with multiple drive bays at that point — look at used Dell or Lenovo micro PCs with SATA ports.
• If your data has strict compliance requirements (HIPAA, financial records), a DIY encrypted cloud backup may not satisfy auditors. You'll need a provider with compliance certifications.
• If you won't test restores, none of this matters. Don't build it if you won't maintain it.

Verdict

A Raspberry Pi 5 with a $40 NVMe drive gives you a silent, 5-watt backup server that writes at 438 MB/s — fast enough to back up most homelabs in minutes. Pair it with a $0.50/month Backblaze B2 bucket and a local USB SSD, and you have a legitimate 3-2-1 setup for under $100 plus pennies in monthly cloud fees. The expensive part isn't hardware — it's the discipline to automate, encrypt, and actually test your restores.