The Lie of "Our Host Does Backups"

Relying solely on your VPS provider's local snapshots leaves you vulnerable if the entire datacenter catches fire, gets hit by ransomware, or suspends your account. You must maintain immutable off-site backups.

The Disaster Recovery Pipeline

  1. Nightly cron dumps MySQL databases using mysqldump --single-transaction --quick to prevent table locking.
  2. Compresses with zstd and encrypts with private GPG keys before writing to disk.
  3. Uploads to an isolated AWS S3 bucket with Object Lock (Write-Once-Read-Many) to prevent deletion by ransomware.
  4. Weekly automated test script spins up a throwaway Docker container, imports the dump, and verifies row-count integrity.