Backup

A backup strategy only counts if it's been tested with an actual restore. The mechanism itself can be simple: a nightly script that archives data volumes, encrypts the result, and prunes old backups beyond a retention window.

tar -czf - ./data | openssl enc -aes-256-cbc -pbkdf2 -pass file:/root/.backup_key > backup_$(date +%F).tar.gz.enc
find /backups -name '*.tar.gz.enc' -mtime +30 -delete

Run the restore procedure at least once, on a throwaway host, before you need it for real. A backup you've never restored from is a hypothesis, not a backup.