Every system I hand over ships with the same backup shape: automated nightly dumps, an off-site copy, and a quarterly restore drill. It's boring, it's cheap, and it works.
Nightly dumps are the easy part, `pg_dump` on a cron, rotated weekly, kept for a month. The part teams skip is the off-site copy. A backup on the same VPS as the database is not a backup; it's a second copy of the same failure.
The restore drill is where the strategy lives. Once a quarter, restore the latest dump to a scratch machine and open the app. If that takes more than an afternoon, your runbook is wrong, fix it while nothing is on fire.
Backups you haven't tested are a hope, not a plan. The drill is the plan.
