Restic Backups (Backblaze B2)
Offsite cloud backup running on both nodes. Backs up Proxmox dump archives and system config to Backblaze B2 (Toronto region). Monitored via Healthchecks.io.
Both nodes run the same scripts from /root/.restic/. Credentials and repository URL are in /root/.restic/env.bash on each host.
Backblaze B2 Buckets
All buckets in the ca-east-006 region (Toronto). All private, server-side encryption enabled. Object lock disabled.
| Bucket | Contents | Lifecycle |
|---|---|---|
pob-pve-backup |
Proxmox dump archives, /etc, /root for both nodes |
Keep last version only |
zpool0-family |
Selected family ZFS datasets | Keep prior versions for 7 days |
zpool0-vault |
Full vault ZFS dataset | Keep prior versions for 14 days |
S3 endpoint: s3.ca-east-006.backblazeb2.com
The version retention on family and vault is a bucket-level safety net — if an object is accidentally deleted remotely, it remains recoverable for the retention window.
Schedule
05:30 — restic backup (after Proxmox jobs at 01:30–02:00 complete)
07:00 — restic retention (prune after backup finishes)
Both timers have Persistent=true and up to 5 min random delay. Backup and retention run as separate systemd services so a retention failure doesn't block the backup.
pve1-media manages retention for both hosts. pve0-core only runs the backup — it does not run the retention service. This avoids repository lock conflicts that would occur if both nodes ran restic forget simultaneously.
What Is Backed Up
pve1-media
| Tag | Source Path | Notes |
|---|---|---|
pve1-media-config |
/etc |
System configuration |
pve1-media-root |
/root |
Root home dir (includes restic scripts) |
pve1-media-dump |
/zpool0/pve-backup/pve1-media/dump |
Proxmox vzdump archives for pve1-media VMs |
pve0-core-dump |
/zpool0/pve-backup/pve0-core/dump |
Proxmox vzdump archives for pve0-core VMs (received via NFS) |
pve0-core
| Tag | Source Path | Notes |
|---|---|---|
pve0-core-config |
/etc |
System configuration |
pve0-core-root |
/root |
Root home dir (includes restic scripts) |
pve1-media — Family ZFS datasets (separate bucket)
Selected datasets from zpool0/family — not all, to keep cloud storage costs reasonable. Large raw files are excluded.
pve1-media — Vault ZFS dataset (separate bucket)
zpool0/vault is fully backed up to its own dedicated B2 bucket. All children included.
Note on encryption: The external disk strategy (syncoid) uses
zfs send --raw— data stays encrypted at rest. Restic backs up the mounted (decrypted) family and vault datasets — encryption is handled by restic itself at the repository level.
Retention Policies
| Tag | Daily | Weekly | Monthly |
|---|---|---|---|
pve0-core-dump |
7 | 2 | — |
pve1-media-dump |
7 | 2 | — |
pve0-core-config |
30 | 8 | 12 |
pve0-core-root |
30 | 8 | 12 |
pve1-media-config |
30 | 8 | 12 |
pve1-media-root |
30 | 8 | 12 |
Dump archives get shorter retention (7 daily / 2 weekly) — Proxmox already keeps 3 local copies. Config and root keep longer retention (30 daily / 8 weekly / 12 monthly) since they're lightweight and changes may go unnoticed.
A full repository integrity check (restic check) runs every Sunday.
Monitoring
Healthchecks.io pings on start and exit code after each run.
Healthchecks.io pings per service (UUIDs in Bitwarden).
Logs are written to /var/log/restic/ and pruned after 30 days.