Hardware fails, drives corrupt, ransomware strikes, and—occasionally—coffee spills happen. In the world of system administration and data management, disaster isn't a matter of if, but when.

While having a single backup of your critical files puts you ahead of most casual users, relying on a single target leaves you vulnerable. If your local backup drive dies at the same time as your workstation, or if a localized fire hits your office, a single destination fails you completely.

Enter the 3-2-1 backup strategy—the undisputed industry gold standard for data protection. In this guide, we’ll explore how to architect a modern 3-2-1 topology and automate multi-destination workflows using Duplicati.

What is the 3-2-1 Backup Strategy?

The core methodology is simple, elegant, and battle-tested:

• 3 Copies of Data: Keep your primary live data plus at least two backup copies.

  
  

• 2 Different Media Types: Store backups on different storage media (e.g., local NVMe/SSD, a local NAS via SMB/SFTP, or enterprise cloud object storage) to guard against medium-specific failures.

  
  

• 1 Offsite Copy: Keep at least one copy in a physically distinct location to protect against localized disasters like theft, flood, or fire.

  
  

                  [ Primary Source Data ]
                             │
            ┌────────────────┴────────────────┐
            ▼                                 ▼
   [ Copy 2: Local LAN Target ]     [ Copy 3: Offsite Cloud Target ]
     (Fast Restore via SMB/SFTP)       (Disaster Recovery via S3/B2)

                  [ Primary Source Data ]
                             │
            ┌────────────────┴────────────────┐
            ▼                                 ▼
   [ Copy 2: Local LAN Target ]     [ Copy 3: Offsite Cloud Target ]
     (Fast Restore via SMB/SFTP)       (Disaster Recovery via S3/B2)

                  [ Primary Source Data ]
                             │
            ┌────────────────┴────────────────┐
            ▼                                 ▼
   [ Copy 2: Local LAN Target ]     [ Copy 3: Offsite Cloud Target ]
     (Fast Restore via SMB/SFTP)       (Disaster Recovery via S3/B2)

By combining fast local restores with resilient, offsite cloud storage, you get the best of both worlds: rapid recovery for daily accidents and complete peace of mind during catastrophic failures.

Designing Your 3-2-1 Topology in Duplicati

To implement this architecture effectively, let's break down a typical enterprise-grade topology using Duplicati:

Duplicati Architectural Tip: Rather than forcing a single backup job to push to multiple targets simultaneously—which introduces cascading point-of-failure risks—Duplicati achieves multi-destination backups through independent, parallel backup jobs. Each job maintains its own deduplication index and local SQLite database, ensuring that an issue with remote cloud connectivity never compromises your local recovery capabilities.

Step-by-Step: Setting Up Multi-Destination Jobs

Option A: Via the Duplicati UI (Web Graphical Interface)

Setting up multi-destination workflows in the Duplicati UI takes only a few minutes.

Step 1: Create the Local LAN Backup Job

1. Open the Duplicati Web UI (http://localhost:8200).

   
   

2. Click Add backup > Configure a new backup.

   
   

3. Name your job (e.g., Local-NAS-Daily). Set a strong encryption passphrase.

   
   

4. Under Destination, select your local target protocol (e.g., SFTP (SSH), SMB / Windows Share, or Local folder/drive).

   
   
   

   • Example: Set Server address to your NAS IP (192.168.1.50) and specify the path /volume1/backups/workstation.

     
     

5. Select your Source Data folders.

   
   

6. Configure your Schedule (e.g., Every day at 12:00 PM).

   
   

7. Save the job and run it to establish your baseline local backup.

   
   

Step 2: Export and Duplicate for Cloud Offsite

Instead of selecting source files from scratch, export your local configuration to create the offsite cloud target:

1. Click on your newly created Local-NAS-Daily job and choose Export... > As Commandline or To File.

   
   

2. Go back to Add backup > Import from a file.

   
   

3. Rename the new job to Cloud-B2-Nightly (or Cloud-S3-Nightly).

   
   

4. Modify the Destination step:

   
   
   

   • Change Storage Type to Backblaze B2, Amazon S3, or S3-compatible storage.

     
     

   • Enter your Cloud Access Keys, Secret Keys, and Bucket Name.

     
     

5. Keep the exact same Source Data selections and encryption passphrase.

   
   

6. Adjust the Schedule to offset it from the local job (e.g., Every day at 2:00 AM).

   
   

Option B: Via the Duplicati Command Line Interface (CLI)

For headless servers or automated administrative scripts, you can execute multi-destination workflows directly via duplicati-cli.

Local Backup Command (SFTP Example):

Bash

duplicati-cli backup "sftp://192.168.1.50/backups/docs?auth-username=admin" \
    /home/user/documents/ \
    --passphrase="YourUltraSecurePassphrase123!" \
    --encryption-module=aes \
    --dblock-size=50MB

duplicati-cli backup "sftp://192.168.1.50/backups/docs?auth-username=admin" \
    /home/user/documents/ \
    --passphrase="YourUltraSecurePassphrase123!" \
    --encryption-module=aes \
    --dblock-size=50MB

duplicati-cli backup "sftp://192.168.1.50/backups/docs?auth-username=admin" \
    /home/user/documents/ \
    --passphrase="YourUltraSecurePassphrase123!" \
    --encryption-module=aes \
    --dblock-size=50MB

Offsite Backup Command (Backblaze B2 Example):

Bash

duplicati-cli backup "b2://my-company-offsite-bucket/docs" \
    /home/user/documents/ \
    --b2-accountid="YOUR_B2_ACCOUNT_ID" \
    --b2-applicationkey="YOUR_B2_APPLICATION_KEY" \
    --passphrase="YourUltraSecurePassphrase123!" \
    --encryption-module=aes \
    --dblock-size=100MB \
    --throttle-upload=5MB/s

duplicati-cli backup "b2://my-company-offsite-bucket/docs" \
    /home/user/documents/ \
    --b2-accountid="YOUR_B2_ACCOUNT_ID" \
    --b2-applicationkey="YOUR_B2_APPLICATION_KEY" \
    --passphrase="YourUltraSecurePassphrase123!" \
    --encryption-module=aes \
    --dblock-size=100MB \
    --throttle-upload=5MB/s

duplicati-cli backup "b2://my-company-offsite-bucket/docs" \
    /home/user/documents/ \
    --b2-accountid="YOUR_B2_ACCOUNT_ID" \
    --b2-applicationkey="YOUR_B2_APPLICATION_KEY" \
    --passphrase="YourUltraSecurePassphrase123!" \
    --encryption-module=aes \
    --dblock-size=100MB \
    --throttle-upload=5MB/s

Pro Tip for CLI Users: Notice the larger --dblock-size (volume size) used for the cloud destination. Increasing the remote volume size from 50MB to 100MB or 200MB reduces the total number of API calls made to cloud providers, directly cutting down storage transaction fees.

Optimizing Performance: Schedules, Throttling, and Staggering

Running multiple backup tasks against the same live dataset can contend for disk I/O and network bandwidth if not managed properly. Here is how to keep local restores blazing fast while offsite transfers run quietly in the background.

1. Stagger Your Schedules

Avoid running local and offsite jobs at the same time. Staggering ensures your local host isn't reading the file system twice simultaneously.

• Local NAS Jobs: Schedule frequently during operational hours (e.g., every 2 to 4 hours or daily at noon).

  
  

• Cloud Offsite Jobs: Schedule once daily during off-peak hours (e.g., 2:00 AM) when internet upload traffic won't interfere with daily work or streaming.

  
  

2. Configure Dynamic Bandwidth Throttling

Cloud uploads can quickly saturate residential or small business WAN connections. Duplicati allows fine-grained bandwidth controls to keep your connection smooth.

In the UI under Options (or Advanced Options):

• Set --throttle-upload: Restrict maximum upload speed (e.g., 5MB/s or 5000KB/s).

  
  

• Set --throttle-download: Restrict download speeds during remote verification checks.

  
  

Duplicati Options -> Advanced Options:
  --throttle-upload = 10MB/s
  --throttle-download = 20MB/s

Duplicati Options -> Advanced Options:
  --throttle-upload = 10MB/s
  --throttle-download = 20MB/s

Duplicati Options -> Advanced Options:
  --throttle-upload = 10MB/s
  --throttle-download = 20MB/s

3. Customize Retention Policies per Destination

Storage capacity on a local NAS is often cheaper per gigabyte than hot cloud storage. Align your retention rules accordingly:

• Local Destination: Use a custom retention policy like 7D:1D,4W:1W,12M:1M (Keep 1 backup per day for 7 days, 1 per week for 4 weeks, and 1 per month for 12 months) to allow fast rollback to recent versions.

  
  

• Cloud Destination: Use a conservative policy like Smart retention or delete backups older than 30 or 90 days to keep your cloud bill predictable and low.

  
  

Summary: Complete Data Resilience

By mastering multi-destination workflows in Duplicati, you eliminate single points of failure without inflating software complexity or licensing costs.

1. Set up independent jobs for local network and offsite targets.

   
   

2. Stagger schedules to keep host disk I/O low.

   
   

3. Throttle cloud uploads so your network stays responsive.

   
   

4. Tune retention policies to balance local agility with cloud cost control.

   
   

With Duplicati automating your 3-2-1 strategy in the background, your data remains fully encrypted, completely secure, and ready for recovery—no matter what comes your way.