The whole config is in git. The data gets backed up nightly by restic and pushed to a local backup site, and then to 2 separate offsite backup locations, fulfilling 3-2-1.

Every month on the first day there’s a restore test.