PBS: Is this a good alternative to a Pull Sync Job that also encrypts my snapshots?

[Zlendy]

Hi everyone,

I basically added localhost as a remote to my PBS instance and created a Push Sync Job to itself on another datastore.

This is the only hacky way I found to effectively make a Pull Sync Job that also encrypts my unencrypted snapshots on the fly.

Do you people know of a better way to do this? Or is this the best known way even though it is probably less efficient than operating strictly on local IO because of networking stuff?

Thanks.

 

[driley]

Hi,

Currently, this is the only way to achieve this [0]. The loopback networking overhead is practically negligible, so performance shouldn't be an issue.

I'm assuming you are doing this to prepare the data for an offsite sync. Otherwise, keeping both the unencrypted and encrypted versions on the same host doesn't really add any security.

[0] https://forum.proxmox.com/threads/its-possible-too-synchronize-datastores-in-the-same-pbs.167848/

 

[Zlendy]

I'm assuming you are doing this to prepare the data for an offsite sync. Otherwise, keeping both the unencrypted and encrypted versions on the same host doesn't really add any security.

Kind of, I'm planning on using two removable disks as offsite backups and periodically swapping them with newer versions of my data.

 

[Johannes S]

I'm doing the same since my offsite PBS is on a vserver and I don't want to store my backups unencrypted on it. But I also want to use pull-sync so my local PBS doesn't need to be allowed to acces the offsite PBS in the firewall/iptables/pbs permission settings.