Inventory what must survive

A backup plan starts with what cannot be recreated. Not with tools, not with schedules. If you don’t know what must survive, you’ll back up the wrong things and discover it during a disaster.

The key distinction is unique data versus reproducible data. Your operating system is reproducible: you can reinstall it. Your application code is reproducible if it’s pushed to Git. But an unpushed repository, a production database, user-uploaded files, and encryption keys exist in exactly one place. Lose them and they’re gone.

Build the inventory

Create a plain inventory without secret values. One entry per thing that matters:

item: customer database
owner: application team
location: production PostgreSQL
changes: continuously
backup method: logical dump plus provider snapshot
restore dependency: database version and encryption key

Every field earns its place. Owner tells you who to call when the restore fails. Changes tells you how often to back it up. Restore dependency is the one people forget: a database dump is useless without a compatible database version, and an encrypted backup is useless without its key.

Now walk through every device, server, cloud service, and personal folder that contains unique data. Your laptop’s ~/Documents. The VPS running your side project. The SaaS tool that holds your invoices. For each one, ask: if this disappeared right now, could I recreate it?

item: family photos
owner: me
location: laptop ~/Pictures plus phone
changes: weekly
backup method: none yet
restore dependency: nothing

An honest backup method: none yet entry is the whole point of this exercise. It turns a vague worry into a task.

What to watch out for

Mark unknown ownership as a problem. Data that belongs to nobody gets backed up by nobody.

Keep credentials out of the inventory itself. This document will be copied, printed, and shared during an incident, so it must be safe to circulate. Record where protected recovery material is held instead: “restic password: in the password manager emergency kit”. That pointer is useful during recovery. The actual secret in a plain text file is a liability.