Category: blog

History

I’ve struggled with finding an uncomplicated, reliable and secure backup strategy in the past. Whereas I’ve looked at services like iCloud, Dropbox and others that are simple to use, I’ve been sure there’s a better approach. Now that I have my own Proxmox VE and PBS servers it was time to look again at the options and finally get a process nailed down.

The situation

As mentioned, I have a Proxmov VE running various linux containers, one of which is ownCloud, a pared-down branch of Nextcloud without all the complicated and unnecessary (for me) bloat. The container itself is backed up along with the others twice-daily to my PBS at midnight.

My ownCloud data lives on an independent 2TB hard drive, mounted via /dev/mapper to be accessible throughout the VE where needed. This is backed up separately as it would make the container backup huge if done in the same place. How do I accomplish this?

Local backup

On the PVE box I have a systemd timer set for 1pm.

Mon 2026-04-06 01:00:00 BST 9h Sun 2026-04-05 01:00:02 BST 14h ago backup-mnt-owncloud.timer backup-mnt-owncloud.service

This fires the 1-shot service backup-mnt-owncloud.service:

[Unit]
Description=Backup /mnt/owncloud to PBS(local)

[Service]
Type=oneshot
ExecStart=/usr/local/bin/backup-mnt-owncloud.sh

And here’s the script itself. It backs up /mnt/owncloud to the owncloud_data namespace on the local-storage datastore on the PBS server.

#!/bin/bash
export PBS_PASSWORD='[REDACTED]'

proxmox-backup-client backup mnt_owncloud.pxar:/mnt/owncloud \
  --repository backup@pbs@10.0.0.3:local-storage \
  --ns owncloud_data \
  --change-detection-mode=metadata \
  --exclude '/mnt/owncloud/steve/files_trashbin' \
  --exclude '/mnt/owncloud/steve/uploads' \
  --exclude '/mnt/owncloud/steve/thumbnails' \
  --exclude '/mnt/owncloud/steve/cache' \
  --exclude '/mnt/owncloud/owncloud.log' \
  --exclude '/mnt/owncloud/crash-*.log'

The --change-detection-mode switch makes sure files don’t get backed up that haven’t been changed since the last backup. PBS has a retention policy for this datastore ensuring that such files are kept for a maximum of 2 years so long as they’re not deleted from the original file structure.

So that’s the local backup taken care of. What else?

Other related backups

At 2am another timer on PVE fires a script to backup system folders to local-storage datastore on the PBS server.

#!/bin/bash
export PBS_PASSWORD='[REDACTED]'
proxmox-backup-client backup etc.pxar:/etc \
  --repository backup@pbs@10.0.0.3:local-storage \
  --ns etc
proxmox-backup-client backup etc_pve.pxar:/etc/pve \
  --repository backup@pbs@10.0.0.3:local-storage \
  --ns etc_pve
proxmox-backup-client backup usr_local.pxar:/usr/local \
  --repository backup@pbs@10.0.0.3:local-storage \
  --ns usr_local
proxmox-backup-client backup var_lib.pxar:/var/lib \
  --repository backup@pbs@10.0.0.3:local-storage \
  --ns var_lib
proxmox-backup-client backup appdata.pxar:/mnt/storage/appdata \
  --repository backup@pbs@10.0.0.3:local-storage \
  --ns appdata

At 2.30am a PBS prune job removes local-storage indexes outside the retention policy

At 3am a garbage collection job (scans the datastore and removes any chunks that are no longer referenced by any snapshot) for local-storage on PBS.

Remote sync to S3 bucket

I use Wasabi S3 storage for remote backups. It’s cheap and reliable. I have a bucket there that is mapped to a datastore on PBS called wasbi-backup (genius, right?).

At 4am a PBS sync job runs to backup the whole local-storage datastore to the Wasabi bucket (with 7 days, 4 weeks, 23 months, 2 years retention policy)

At 4.30am and 5am the prune and garbage collection jobs are run for the wasabi-backup backups.

Belt & braces

At 4am I also have an ArqBackup job on my local mac mini backing up my ~/owncloud folder to a separate Wasabi bucket.

---

“Sothern Surety Building, The Sacung and Loan Building – Aparium Hotel Group – Previous Safe & Vault & Safe Boxes for People to view staying in the Hotel – Des Moines – Iowa l” by Onasill – Bill Badzo – 149 Million Views – Thank Y is licensed under CC BY-NC-SA 2.0