3-2-1 Backup Strategy with restic and Backblaze B2

# 3-2-1 Backup Strategy | Chuck Carroll Source: [https://chuck.is/paranoid/](https://chuck.is/paranoid/) --- ## Implementing a 3\-2\-1 Backup Strategy with restic and Backblaze B2 Published: 2026\-10\-09In order to follow a proper 3\-2\-1 backup strategy, you should have three copies of your important data: two local on different media types, and one off site\. For local, I have a[DAS](https://en.wikipedia.org/wiki/Direct-attached_storage)with two 14TB drives configured in a RAID 1 array[1](https://chuck.is/paranoid/#fn1)and a RPI5 with a 4TB drive \(my most important data is around 1\.5TB\)\. For the off site copy, I opted to utilize Backblaze's B2 Cloud Storage and restic\. Backblaze is a cloud storage provider, while Restic encrypts and chunks the files before upload\. Restic is responsible for uploading, encryption/decryption, and deduplication\. ### Set up a Backblaze B2 bucket To begin, I had to configure Backblaze\. 1. Create a Backblaze account 2. Create a bucket \(I called mine restic\-ganymede\) 3. Under application keys, make a key\. Be sure to copy the keyID and applicationkey as they're only shown only once\. I keep this in my password manager notes for Backblaze "B2 Account ID and Key"\. 4. In the bucket, select "Lifecycle Settings" and choose " Keep only the last version of the file" or pruned chunks will linger and you end up paying for it\. 5. Add a payment option, otherwise the backup will fail after the initial 10GB free tier\. ### Set up restic on the local machine Now for the local configuration\. Create the directory /etc/restic`sudo mkdir /etc/restic`\. /etc/ is the conventional spot for system\-wide configs\. This matters because the systemd service runs as root, not as the user\. Create b2\.env in this new directory and add the following: ``` B2_ACCOUNT_ID=your_account_ID B2_ACCOUNT_KEY=your_applicationKey RESTIC_REPOSITORY=b2:restic-ganymede:ganymede RESTIC_PASSWORD_FILE=/etc/restic/password ``` Create a password with`openssl rand \-base64 32 \| sudo tee /etc/restic/password`\. Be sure to store the password in a password manager \- and even consider printing this out\. This also goes into my password manager notes for Backblaze "restic repo encryption key"\. If this password is lost, you will not be able to decrypt the data\. Then ensure the permissions are correct with`sudo chmod 600 /etc/restic/password /etc/restic/b2\.env`\. ### Initiate the first run Now intialize the first run: ``` sudo -i set -a; source /etc/restic/b2.env; set +a restic init restic backup /path/to/photos /path/to/documents --verbose ``` For me, this took about 50 hours on my cable internet connection that tops out at 60Mbps upload to upload 1\.2TB of data\. Restic encrypts everything before it's uploaded to backblaze\. B2 holds only opaque encrypted blobs so even if this data is compromised, nobody will be able to decrypt it\. That said, if you lose your password, the data is not recoverable\. ### Automate Restic Once completed, the restic systemd service can be automated to run on a schedule\. I've opted to do nightly at 3am\. Run`sudo vim /etc/systemd/system/restic\-backup\.service`and add the following: ``` [Unit] Description=Restic backup to B2 After=network-online.target Wants=network-online.target [Service] Type=oneshot EnvironmentFile=/etc/restic/b2.env ExecStart=/usr/bin/restic backup /path/to/photos /path/to/documents ExecStart=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune Nice=10 IOSchedulingClass=idle ``` Then set up the time with`sudo vim /etc/systemd/system/restic\-backup\.timer`and add the following: ``` [Unit] Description=Nightly restic backup [Timer] OnCalendar=*-*-* 03:00:00 RandomizedDelaySec=1800 Persistent=true [Install] WantedBy=timers.target ``` Enable the services with the following:``` sudo systemctl daemon-reload sudo systemctl enable --now restic-backup.timer sudo systemctl list-timers restic-backup.timer ``` ### Disaster Recovery Lets say my home office goes up in flames and both my RAID1 array and Pi5 are destroyed\. How do I recover? I'd start by installing restic and recreating the files:`/etc/restic/password`with the restic password and`/etc/restic/b2\.env`with the Backblaze details \(B2keyID, applicationKey, the bucket name, and the location of the restic password file\)\. These details I've saved in my password manager\. Both files get chmod 600\. Then source the env file with`set \-a; source /etc/restic/b2\.env; set \+a`and run`restic snapshots`to ensure it's accessible\. Create the directory where the restore will go, like`sudo mkdir \-p /mnt/recovery`, and then restore with`restic restore latest \-\-target /mnt/recovery`\. Files land under their original path inside the target, so I'd see something like`/mnt/recovery/mnt/ganymede/`so plan accordingly\. It's also probably helpful to occasionally run`restic check`and do an actual test restore\. I'd hate to have my home burn down then also discover that I lost all my important data\! And with that said, I can now sleep a little easier at night\. *Thanks for reading\. Feel free to send comments, questions, or recommendations to[\[email protected\]](https://chuck.is/cdn-cgi/l/email-protection#650d001c25060d10060e4b0c16)\.* --- 1. I don't consider the duplication from the RAID array to be part of the 3\-2\-1 backup strategy since both disks hold the same live filesystem and a deletion or corruption hits both at one\. RAID protects against drive failure\.[↩](https://chuck.is/paranoid/#fnref1)