Sync or backup to cloud PBS

[Str1atum]

Hi!

I have setup a PVE environment with one local bare-metal PBS and one cloud PBS for offsite-backups.
Cloud backups must be encrypted, local could be.
The offsite PVS is connected via VPN to my local network, the network speed is not optimal, a full initial backup will take several days.

I wonder that's the best way to get the backup organized.

1. Encrypted datastore to cloud PBS and unencrypted datastore to local PBS - two separate backup jobs from PVE
2. Encyrpyted datastore to local PBS, cloud PBS syncs to local PBS

Any considerations regarding backup speed / deduplication? Or how do you organize such a situation?

Best,
Str1atum

 

[Chris]

Hi,
please note that encryption is handled by the PBS client, not the PBS server, so there is no such thing as an encrypted datastore.

Given that, you could do the following:

1. Create 2 separate namespaces on your local PBS instance, one designated for encrypted, one for unencrypted backup snapshots.
2. Setup the PBS storage on PVE, one with encryption to the encrypted namespace, one without encryption to the unencrypted namespace.
3. Setup 2 backup jobs, one with the encrypted storage as backup target, one for the other.
4. Create a sync job on the remote PBS (cloud) to pull only the encrypted backups from the corresponding namespace.

 

[Str1atum]

Thanks for pointing out the namespace feature!

What's the advantage of just backing up directly to the PBS cloud instance with encryption on? Is sync faster or more efficient?

 

[Chris]

Thanks for pointing out the namespace feature!

What's the advantage of just backing up directly to the PBS cloud instance with encryption on? Is sync faster or more efficient?

Direct backups from your PVE cluster to the remote PBS instance will very likely suffer from the high latency and low bandwidth, possibly causing issues with guest IO. While the sync has the same latency issues, it is independent from the guests, therefore less problematic.

You could of course also setup backup fleecing to reduce impact on the guest IO in case of direct backups.