Q: usage scenario clarification for (one offsite PBS server, 2 different proxmox nodes)

[fortechitsolutions]

Hi, I have a "small fun" question I am trying to understand. I've reviewed the docs and I am a bit unclear so wanted to ask.

So far I have Proxmox Backup Server Setup a few times now and working very nicely in simple use case, ie,
one proxmox host
one PBS server
weekly incremental backups from Proxmox > PBS box to the data store that is configured and designated there.

So - yay - PBS is amazing and works well.

I'm trying to understand if what I want is possible on a different / second use case; or how one could achieve if it if requires some more advanced config in PBS .

scenario:
Client has a small (2 node) proxmox cluster in production at office with about 10 VM in total running

Recently I setup an offsite proxmox node hosted @ OVH. I copied up some cold backups of the 10 VM from the office, and things spun up nicely in the 'offsite DR Proxmox' environment fine. I then setup a second box at OVH, running PBS, and have it linked to the OVH_Offsite Proxmox server, and it can easily get weekly incremental backups from this one Proxmox host.

What I'm curious about.
-- the production office proxmox stuff was setup before PBS existed. So it uses presently a simple 'legacy style' NFS NAS target for local backup jobs that run weekly. These are 'pretty big' and no dedup since that is how baseline backup works in proxmox.

Ideally what would be really (!) nice. Something like this?

-- Office Proxmox can send backup jobs to offsite PBS server. After the first full pass then subsequent backups are incremental-dedup style / smaller data footprint for data xfer (ie, changes only are sent, not full VM image each backup cycle).

-- in case office Proxmox blows up. Some way for me to restore (Office Proxmox VM latest Backup) so it can run on the OVH_offsite_Proxmox server.

Right now I can see it is 'easy' to make a 1:1 relationship between a specific proxmox host and a specific PBSatastore target.
What I am less clear on is if there is a way to designate a 'trust' relationship so that we can do this kind of not-1-to-1 relationship, ie, a "Disaster recovery scenario" where we wish to access (Production onsite VM Backup) from the (DR offsite proxmox host) for purpose of VM restore.

I can't tell (for example) if the 'easy' way to do this might be
-- setup one datastore on the PBS server
-- configure ONSITE_PROXMOX to dump backups to this PBS:datastore
-- then also setup OFFSITE_Proxmox to also use same PBS:datastore. In so doing I am forcing shared trust / and both hosts now get access to all backups in this datastore / despite each host only being involved in creation of some-but-not-all-content there.
OR

- if PBS requires a 1:1 relationship between (proxmox host) and (datastore)

OR
- if there is some other clever way to perform a VM_DATA_RESTORE from PBS on an as-needed basis for example?

I have already tested something like this, kind of
-- simpler scenario
-- single proxmox host, single PBS host
-- use the CLI proxmox-backup-client from the proxmox host
-- I believe we can do things like a restore request to the PBS host, if I designate correctly the (Backup identifier) and (dataStore) and also provide proper creds for access / and am accessing a PBS host with which the proxmox node already has a trust relationship.

but I'm not so clear if there is a way to do this which is more of a 'restore to a new proxmox host that is NOT where the PBS backup job was generated from".

The 'old school' model was nice and simple, ie,
-- proxmox1 node dumps backups into NFS storage tank.
-- once backups are done those backup dump files exist
-- any host that can see these backup files, has access to them, and I can copy them out of the NFS tank / to a different proxmox host.
-- or even if I setup a trust relationship temporarily (ie, NFS mount the "NFS Backup Tank" from PROX2 node) - I may now browse the content of this NFS tank, which includes backup VM dumps from PROX1 node. And it is trivial to just say, via WebUI, "browse datastore" > Locate Backup file > RESTORE. And thus in this manner is trivial way to get a (restore of VM that was dumped from PROX1) >> stored in NFS Tank >> restored onto PROX2 node.

Anyhow. Kind of overly wordy -sorry about that.

End of the day I guess I am trying to understand what the 'simplest, most reliable' way might be to manually implement some kind of workflow which permits me to

-- have one Proxmox node do weekly VM backups to a PBS server
-- and then in case I have an "OH Crap the server blows up" situation, I can (somehow, manually) get onto (Proxmox Node2) and then somehow access the backups on PBS server / to restore copies of (latest VM backups generated by Prox1 node) and restore them onto (Prox2 node) so we can light things up in production again at the alternate proxmox node. Without too much pain and drama.

Many thanks for reading this far, and any gentle pointers are greatly appreciated.


Tim

 

[dylanw]

Hi Tim,
I'll try to answer the key topics of your post.
First, usually it is recommended to have Proxmox Backup Server on site for the fastest recovery options, but as long as you have no problem with backup/restore speeds to/from the offsite network, I'll say no more about this.

Otherwise, what you're describing seems like quite typical usage of Proxmox Backup Server. The "trust" relationship you mentioned mostly comes down to user management and access control [1]. You could, for example, set up one or more users on the backup server with DatastoreBackup permission, which only allows for backing up and restoring owned backups. As this is on the backup server side, the user can be used to restore on to any other PVE host. You would just need to add the PBS storage to the node.

The only thing to ensure is that the 2 node cluster remains in quorum [2], if the node 1 goes down. Perhaps a QDevice [3] would be worthwhile, or you can always force a quorate state. Or just have these nodes entirely separate, if the purpose of one is purely a recovery option.

Did I answer everything or is there something else in there you wanted addressed?

[1] https://pbs.proxmox.com/docs/user-management.html#
[2] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_quorum
[3] https://pve.proxmox.com/pve-docs/pve-admin-guide.html#_corosync_external_vote_support

 

[fortechitsolutions]

Thanks for the quick, clear, detailed reply. Greatly appreciated. I do appreciate onsite vs offsite will have impact on the recovery/data transit times.

In this use case we don't have any desire for a 'cluster' proxmox to span (onsite box/es) (and offsite). Rather the offsite is being treated as a manual failover environment that is to be 'standalone'. So the issues of quorum and cluster config are easy/non-issues here.

I think my main confusion was around the anticipated use case for access to VM Backups. And it seems this is purely controlled based on user / permissions which a given user has to datastores/backups. I will do a few tests to see if I can (for example)

have my onsite hosts push backups to the offsite PBS host.
then the offsite manual-failover proxmox. temporarily link it to the PBS host using either superuser admin creds, or a suitable user which has access rights to the backups generated from the (onsite host)
and then attempt a VM recovery to the (offsite host) of one of these (onsite host VM backups) to validate it works as expected.

End of the day my use case here is very simple (I think) - in that it is purely for a manual failover process / and the only thing that needs to happen on a regular/scheduled way - is the backups of (Onsite proxmox VMs) to the (offsite PBS server). Which ensures we have ~current offsite backups available. So that if we have an outage event at the (onsite platform) we have a way to manually bring VMs online in the alternate (offsite proxmox) with modest manual effort.

Thanks again for your help!

Tim