Newbie questions: retention, datastore,

[masgo]

I have been using PVE for some years and I want to also use PBS now. It seems like I don't quite get some of the concepts.
My setup is: one PVE cluster and one PBS on a separate physical machine.
The PBS has 1 SSD as boot drive (with zfs) and a raid-z2 array of 6 HDDs for storage (called localHDD)

Questions
Networking
Each node of my PVE cluster has 2 Gigabit NICs which connect to separate switches (Link 0 with IPs 10.x.x.x and Link 1 with IPs 192.168.x.x). Link 0 is used for corosync, Link 1 for VM traffic and everything else.
My PBS has two Gigabit NICs as well. How should I configure it? Use only one NIC and connect it ot Link 1? .. Use both NICs in an LACP bond to the Link 1 switch (this would allow for parallel backups from different PVE nodes). .. Other ideas?

Datastores
I want to use the raid-z2 array to store PBS backups and samba shares for application-level backups. I also want to have storage quotas for each of them.
If I understood the access control, I can only give a user datastore access. So in order to separate datastore access of different teams, i need different datastores?
Should I create zfs sub-filesystems (localHDD/pbs-teamA, localHDD/pbs-teamB, localHDD/samba, ...etc.) and add them as datastores to PBS? Is this a good idea? / A normal way to do it?

Retention / pruning
It looks like, I can configure retention policies in the PVE backups. In that case the user needs to have prune rights on the datastore. This is a security problem if the PVE cluster should be hacked/infected, because the hacker could delete the backups, right?
So I should only handout the Datastore.Backup right, and not Modify and Prune, correct?
Then I need to configure retention policies in the PBS interface. But how do I define different policies for different VMs?

What are namespaces?

Dedpuplication / Incremental backups
I have read that PBS does use deduplication and incremental backups. Can I configure this somehow? How is it done? zfs-dedup? The documentation is very brief here.

Remote Sync
I want to store the Backups in two different locations. Do I need another PBS or is a simple NAS good enough?

 

[floh8]

Each node of my PVE cluster has 2 Gigabit NICs which connect to separate switches (Link 0 with IPs 10.x.x.x and Link 1 with IPs 192.168.x.x). Link 0 is used for corosync, Link 1 for VM traffic and everything else.

its better to have separat Nics or Vlans for Client, Management and Backup Network. So, u should buy more network cards.

Should I create zfs sub-filesystems (localHDD/pbs-teamA, localHDD/pbs-teamB, localHDD/samba, ...etc.) and add them as datastores to PBS? Is this a good idea? / A normal way to do it?

For samba it is a good idea to create a subvol, but different datastore do not need this. A datastore is a Folder in the Volume.

Then I need to configure retention policies in the PBS interface. But how do I define different policies for different VMs?

retention is always according to a datastore not to the objects of a datastore.

What are namespaces?

yes, there are no explaination. namespaces are like groups, so you can store VMs with the same name/ID from different clusters

Can I configure this somehow? How is it done? zfs-dedup?

no. it's always built-in dedup and compression and incremental. no use of zfs features.

I want to store the Backups in two different locations. Do I need another PBS or is a simple NAS good enough?

Normally u use a second or third PBS as remote server for syncing. Of course, U can use a remote zfs server to send a zfs vol.

 

[floh8]

If I understood the access control, I can only give a user datastore access. So in order to separate datastore access of different teams, i need different datastores?

yes