The most viable solution is to get a machine snapshot. Full detail from the mailing list:

We have discussed the a backup strategies in the past several times.
Replicas a definitely viable. If there is a data corruption there are
ways to deal with it though it is extremely rare situation.

The problem is that saving just database is not enough. There are certs,
keys, config files, NSS database etc. that needs to be backed too. As
IPA is trying to hide all this complexity on one side and is changing as
we develop new functionality on the other we thought that for cases like
yours it might make sense to save a snapshot of the machine image rather
than only backup the content of the LDAP.