Depends on your paranoia/fault tolerance level. In general some form of the 3-2-1 backup rule. Personally I use arqbackup:
- Local live copy
- Hourly differential backups to another network share
- Hourly differential backups to an s3 compatible bucket with object lock and versioning so malware can’t wipe the latest 3 months or so.
Edit: I also forgot, 2 and 3 don’t exist unless you’ve verified that you can restore from them recently.