backup security

Modern ransomware targets backups first; this guide shows how to harden a Linux backup pipeline with encrypted restic/borg, least‑privilege systemd automation, and lightweight AI anomaly detection (Isolation Forest) to flag size/runtime/file-count outliers. It includes apt/dnf/zypper installs, Bash-first workflows, optional GPG signing, immutability/air‑gaps, and regular restore tests to freeze, alert, and preserve good restore points.