@Brandon Lee Good question. This is where a lot of bare-metal and VPS setups fall short. Here's my approach: 1. Provider snapshots are a bonus, not the plan. I keep them on for quick rollbacks, but they sit with the same provider and are only crash-consistent, so I don't count them as DR. 2. Configs live in Git: Docker Compose files, reverse proxy configs and Ansible playbooks, with secrets stored separately and encrypted. That lets me rebuild a host from scratch instead of restoring it. 3. Databases get dumped, not copied. I run pg_dump or mysqldump before each backup, because copying a live data directory often gives you a backup that won't restore. 4. Persistent data goes offsite with restic (Borg and Kopia work well too). Bind-mounted volumes and the DB dumps are encrypted, deduplicated and sent to S3-compatible storage like Backblaze B2. It runs nightly on a systemd timer with retention rules, and healthchecks.io alerts me if a job fails. 5. I test restores. About once a month I restore to a fresh VPS and check that the app actually starts. A backup you've never restored is just a guess. So the DR plan comes down to: spin up a VPS, run the playbook, pull the latest restic snapshot.