I have a simple script that tars and gpg encrypts specific directories nightly. It’ll also reap backups in a sane way (only keep one per week for the last month, one per month for the last year, etc). And it’ll stop/start services/containers while backing up as needed. Then I distribute the backups to various devices using Syncthing.

I’ve been thinking about also having an off-site backup (for a house fire, electrical storm when everything is plugged in, etc), but that might be slightly paranoid.