Remote Backup Server Best Practices

[engineer5]

I've searched for a best-practice guide for using a remote Proxmox Backup Server, but came up empty.

I have a very well working PBS, and want to set up a remote PBS at a different location. The locations are connected via VPN, with limited bandwidth (50 MBit usable for backup, I'm guessing).

Q1: I've searched the docs and it explains that there are two ways to schedule remote-sync'ing, either push-sync or pull-sync. What is the best practice here today?
Q2: If I only want a smaller amount of backups stored in the remote location, can I manage that? E.g.:
* can I select only backups of VMs 105-108 to replicate to the remote location and 109-115 not?
* can I select that the holding/pruning pattern is different on the local and the remote PBS? Eg. on the local I want monthly backups stored 5 years (=60 last monthly), on the remote I just want the 3 last monthly backups?
Q3: is it possible to set up the "remote PBS" at first directly in the local LAN (with a local IP), do the first remote-sync, and then move it to the remote location, and change the "remote-PBS" IP address to the remote IP, and modify the "remote Entry" on the local-PBS, so that the push-sync (or pull-sync) is working without having to send all stuff again?

Thanks for your answers!

E#5

 

[Chris]

Hi,

I've searched for a best-practice guide for using a remote Proxmox Backup Server, but came up empty.

I have a very well working PBS, and want to set up a remote PBS at a different location. The locations are connected via VPN, with limited bandwidth (50 MBit usable for backup, I'm guessing).

Please note that sync speeds might also depend on the latency between the source and destination, for details see https://bugzilla.proxmox.com/show_bug.cgi?id=4182 and especially consider the comment https://bugzilla.proxmox.com/show_bug.cgi?id=4182#c12 regarding congestion control.

Q1: I've searched the docs and it explains that there are two ways to schedule remote-sync'ing, either push-sync or pull-sync. What is the best practice here today?

This depends on what you want to achieve: pull syncs require the source to be accessible via the API, which was not always possible. Therefore, sync jobs in push direction were introduced. Sync jobs in pull direction only require read access to the remote and have a few more features such as resync of corrupt snapshots, so I would recommend to use these when possible (at the time of writing this at least).

Q2: If I only want a smaller amount of backups stored in the remote location, can I manage that? E.g.:
* can I select only backups of VMs 105-108 to replicate to the remote location and 109-115 not?

Yes, sync jobs allow to set group filters, so you can exclude/include specific backup groups only.

* can I select that the holding/pruning pattern is different on the local and the remote PBS? Eg. on the local I want monthly backups stored 5 years (=60 last monthly), on the remote I just want the 3 last monthly backups?

Yes, pruning is independent for source and target, in general it makes however sense to set the prune setting such that you are not pruning and re-syncing snapshots multiple times. Sync jobs only ever allow to sync snapshots which are newer than the last snapshot already present on the target, so keep that in mind as well.

Q3: is it possible to set up the "remote PBS" at first directly in the local LAN (with a local IP), do the first remote-sync, and then move it to the remote location, and change the "remote-PBS" IP address to the remote IP, and modify the "remote Entry" on the local-PBS, so that the push-sync (or pull-sync) is working without having to send all stuff again?

Yes, as long as the network changes are reflected in the configs after changing location, the PBS instance does not really care whether the machine was first setup locally and then moved to a remote location. Remote only reflects the fact that the PBS instance is not the same host (although you even can setup one PBS instance to be it's own remote via localhost).
Note: It is also possible to define removable datastores, so an initial sync could be performed by that as well.

Thanks for your answers!

E#5

 

[Johannes S]

Pull sync jobs have also the advantage that you can block access to the remote pbs from your local network for ransomware protection with iptables. In case of restore you can temporary disable the Block rule and reenable it afterwards. The PBS manual chapter on ransomware protection is worth a read:
https://pbs.proxmox.com/docs/storage.html#ransomware-protection-recovery