I lost The Drowned BBS message base once. Not to a hacker, not to a disk failure — to me, running the wrong rm in the wrong directory at the wrong hour. That's when 3-2-1 stopped being a slogan and started being a rule I actually follow.

Three copies of the data. Two different media. One of them off-site. For me that's the live disk, a local NAS snapshot, and an encrypted nightly push to object storage:

restic backup /srv /opt/bbs --tag nightly
restic forget --keep-daily 7 --keep-weekly 4 --prune

But the part everyone skips is the only part that matters: test the restore. A backup you've never restored is a hypothesis, not a backup. Once a month I pull last night's snapshot into a throwaway VM and make sure it actually boots. The night you need it is a bad night to discover it was broken all along.