Start from restore requirements

A backup plan begins with recovery, not a command.

Most people start from the tool: install something, point it at /, schedule it nightly, done. Then the disk dies and they discover the nightly run means losing a full day of orders, or that restoring takes six hours while the RAM-cached database they never dumped is gone entirely. The tool was fine. The requirements were never written.

Two numbers first

The recovery point objective (RPO) describes tolerable data loss in time. If the server dies right now, how old can the data you restore be? An RPO of 24 hours permits nightly backups. An RPO of 15 minutes demands something continuous or near-continuous.

The recovery time objective (RTO) describes tolerable downtime. How long can the service stay down while you rebuild? An RTO of a week tolerates manual, documented restores. An RTO of an hour requires rehearsed automation and locally available copies.

Both numbers are business decisions, not technical ones. Your job is to write them down and design backward from them.

Inventory what must return

Inventory application data, database state, configuration, secrets, and rebuildable artifacts separately, because each restores differently:

sudo du -sh /var/lib/postgresql /srv/uploads /etc/nginx /etc/letsencrypt
# 4.2G  /var/lib/postgresql
# 18G   /srv/uploads
# 124K  /etc/nginx
# 36K   /etc/letsencrypt

Database state needs a consistent dump, not a file copy. Secrets need protected storage. And rebuildable artifacts — packages, containers, compiled output — should usually be excluded: backing them up wastes space and restore time on things apt or your deploy pipeline recreates.

Then write the answers where the restorer will find them:

service: shop.flaviocopes.com
rpo: 1 hour          # max tolerable data loss
rto: 4 hours         # max tolerable downtime
restore owner: flavio
must restore: postgres DB, /srv/uploads, nginx config, TLS certs
rebuildable: OS, packages, app code (git), containers
first test: place a test order end to end

That last line matters. “Backup completed” proves nothing; a named user-visible test proves recovery.

Choose one service. Write its RPO, RTO, restore owner, required data, and the first user-visible test that proves recovery.