--- title: "Implementing a 3-2-1 Backup Strategy with restic and Backblaze B2" slug: implementing-a-3-2-1-backup-strategy-with-restic-and-backblaze-b2 url: https://listedarticles.com/articles/implementing-a-3-2-1-backup-strategy-with-restic-and-backblaze-b2 canonical_url: https://chuck.is/paranoid/ content_type: tutorial language: en published_at: 2026-10-09T12:00:00.000Z updated_at: 2026-10-12T05:11:35.321Z author: "Chuck Carroll" author_url: https://chuck.is/ authored_by: human publisher: "Chuck Carroll" publisher_url: https://chuck.is/ topics: ["Privacy", "Infrastructure", "Tutorials"] license: all-rights-reserved word_count: 660 reading_minutes: 3 citation: "Chuck Carroll, Chuck Carroll. \"Implementing a 3-2-1 Backup Strategy with restic and Backblaze B2.\" 9 Oct 2026. https://chuck.is/paranoid/ (all-rights-reserved)" # The full text follows. The web page shows an extract and sends readers # to the source above; quote the citation and link the canonical URL. --- # Implementing a 3-2-1 Backup Strategy with restic and Backblaze B2 > In order to follow a proper 3-2-1 backup strategy, you should have three copies of your important data: two local on different media types, and one off site. For local, I have a [DAS]() with two 14TB drives configured in a RAID 1 array[1]() with two 14TB drives configured in a RAID 1 array[1]() and a RPI5 with a 4TB drive (my most important data is around 1.5TB). For the off site copy, I opted to utilize Backblaze's B2 Cloud Storage and restic. Backblaze is a cloud storage provider, while Restic encrypts and chunks the files before upload. Restic is responsible for uploading, encryption/decryption, and deduplication. To begin, I had to configure Backblaze. Now for the local configuration. Create the directory /etc/restic sudo mkdir /etc/restic . /etc/ is the conventional spot for system-wide configs. This matters because the systemd service runs as root, not as the user. Create b2.env in this new directory and add the following: B2_ACCOUNT_ID=your_account_ID B2_ACCOUNT_KEY=your_applicationKey RESTIC_REPOSITORY=b2:restic-ganymede:ganymede RESTIC_PASSWORD_FILE=/etc/restic/password Create a password with openssl rand -base64 32 | sudo tee /etc/restic/password . Be sure to store the password in a password manager - and even consider printing this out. This also goes into my password manager notes for Backblaze "restic repo encryption key". If this password is lost, you will not be able to decrypt the data. Then ensure the permissions are correct with sudo chmod 600 /etc/restic/password /etc/restic/b2.env . Now intialize the first run: sudo -i set -a; source /etc/restic/b2.env; set +a restic init restic backup /path/to/photos /path/to/documents --verbose For me, this took about 50 hours on my cable internet connection that tops out at 60Mbps upload to upload 1.2TB of data. Restic encrypts everything before it's uploaded to backblaze. B2 holds only opaque encrypted blobs so even if this data is compromised, nobody will be able to decrypt it. That said, if you lose your password, the data is not recoverable. Once completed, the restic systemd service can be automated to run on a schedule. I've opted to do nightly at 3am. Run sudo vim /etc/systemd/system/restic-backup.service and add the following: [Unit] Description=Restic backup to B2 After=network-online.target Wants=network-online.target [Service] Type=oneshot EnvironmentFile=/etc/restic/b2.env ExecStart=/usr/bin/restic backup /path/to/photos /path/to/documents ExecStart=/usr/bin/restic forget --keep-daily 7 --keep-weekly 4 --keep-monthly 12 --prune Nice=10 IOSchedulingClass=idle Then set up the time with sudo vim /etc/systemd/system/restic-backup.timer and add the following: [Unit] Description=Nightly restic backup [Timer] OnCalendar=*-*-* 03:00:00 RandomizedDelaySec=1800 Persistent=true [Install] WantedBy=timers.target Enable the services with the following: sudo systemctl daemon-reload sudo systemctl enable --now restic-backup.timer sudo systemctl list-timers restic-backup.timer Lets say my home office goes up in flames and both my RAID1 array and Pi5 are destroyed. How do I recover? I'd start by installing restic and recreating the files: /etc/restic/password with the restic password and /etc/restic/b2.env with the Backblaze details (B2keyID, applicationKey, the bucket name, and the location of the restic password file). These details I've saved in my password manager. Both files get chmod 600. Then source the env file with set -a; source /etc/restic/b2.env; set +a and run restic snapshots to ensure it's accessible. Create the directory where the restore will go, like sudo mkdir -p /mnt/recovery , and then restore with restic restore latest --target /mnt/recovery . Files land under their original path inside the target, so I'd see something like /mnt/recovery/mnt/ganymede/ so plan accordingly. It's also probably helpful to occasionally run restic check and do an actual test restore. I'd hate to have my home burn down then also discover that I lost all my important data! And with that said, I can now sleep a little easier at night. Thanks for reading. Feel free to send comments, questions, or recommendations to [[email protected]]().