Designing a GFS Backup Solution with Multiple Proxmox Backup Servers

From VMware to Proxmox: Rethinking Backup Strategy for 2025

Backups aren’t optional. They’re common sense. And if you don’t agree, your corporate insurance provider and your industry regulators almost certainly do. Whether it’s ISO 27001, APRA CPS 234, or the ACSC Essential Eight, every framework assumes you have reliable backups that are tested, retained, and recoverable.

The question isn’t whether you need a backup strategy. The question is whether the one you’ve got will stand up to ransomware, audits, and outages. That’s where Proxmox Backup Server (PBS) comes into play. It brings enterprise-grade features like deduplication, compression, encryption, and instant restores without the licensing costs of legacy platforms. For anyone planning or already mid-way through a Proxmox migration, it integrates seamlessly with Proxmox VE and gives you the chance to rethink how backups are done.

But a single PBS is not enough in production. To build real resilience, you need a Grandfather-Father-Son (GFS) retention strategy stretched across multiple PBS instances. Done right, that gives you fast local recovery, hardened offsite copies, and compliance-ready archives all with the control and sovereignty that comes with running Proxmox VE.

Understanding GFS Retention

The GFS model has been around for decades because it works. The “sons” are your daily backups, the “fathers” are your weekly ones, and the “grandfathers” are the monthly or yearly archives that tick the compliance box.

Without GFS, you either keep too little (and discover too late that you can’t roll back to where you need) or you keep too much (and watch your storage vanish under a mountain of useless restore points). With GFS, you have structure. You know yesterday’s VM snapshot is there, last month’s is there, and last year’s is there too.

That predictability is exactly what auditors want to see. It’s also what IT admins need when they’re trying to restore a system.

Why Multiple Proxmox Backup Servers Matter

Here’s the problem with running one PBS: if it goes down, you’ve lost your backups. If ransomware encrypts it, you’re done.

With multiple PBS instances, the story changes. Your local PBS can sit close to your production Proxmox VE cluster with fast NVMe-backed ZFS storage for daily and weekly backups. A second PBS, maybe sitting in another data centre, another office, or even a sovereign Australian cloud, holds nightly synchronised copies. That remote PBS becomes your compliance and disaster recovery anchor.

For organisations in Australia, this also answers the data sovereignty question. You can keep short-term backups local, and long-term archives in a separate Australian data centre, all under your control. No offshore copies, no uncertain regulations.

This is the kind of layered backup architecture that gives confidence to boards, auditors, and customers alike.

Designing a Multi-PBS GFS Backup Architecture

There are two main ways to design this:

• Direct to multiple PBS servers – Your Proxmox VE nodes send backups to two PBS servers at once. Each one manages its own retention.
• Cascading sync jobs – Your Proxmox cluster writes to a local PBS, which then syncs backups to the remote PBS.

For most Australian businesses, the second model works best. It reduces WAN load, keeps production clean, and still gives you the redundancy you need.

The storage backend matters too. ZFS is the powerhouse: deduplication, snapshots, self-healing. But it loves RAM. ext4 is stable and efficient for smaller PBS deployments. btrfs sits in the middle with checksums and snapshots but a smaller ecosystem. The point is, you can tune each PBS to its role. Local gets speed. Remote gets capacity.

How Sync Jobs Actually Work

A sync job in PBS isn’t a dumb copy. It’s surprisingly intelligent. It knows about deduplication and only moves data chunks the target doesn’t already have.

Here’s an example of what that looks like in practice:

A manufacturer in Brisbane runs twenty virtual machines. Their Proxmox cluster backs up to a local PBS every night. At 2 a.m., the local PBS syncs to a secondary PBS in another Brisbane data centre. The first sync is heavy, but after that, only changed blocks move. A 200 GB VM with 5 GB of changes sends just 5 GB across the link. The WAN stays under control, and the remote PBS quietly builds its monthly and yearly archive without stress.

Now think of a regional law firm. Their branch PBS handles nightly backups, but their WAN to head office tops out at 50 Mbps. Sync jobs kick off at 11 p.m., and because deduplication only moves changed chunks, the nightly delta is around 3-4 GB. The sync finishes well before staff arrive. Head office ends up with a single authoritative archive, while the branch keeps its own short-term recovery points.

This is what makes PBS powerful in multi-site setups. Local gives you speed. Remote gives you compliance and resilience. And because each PBS applies its own retention rules, one server pruning aggressively doesn’t touch the other’s long-term copies.

Garbage Collection and Pruning

Pruning and garbage collection are the unsung heroes here. We love them. A prune job marks expired backups, while garbage collection actually reclaims the deduplicated chunks no longer used by any snapshot.

In a multi-PBS setup, this really starts to matter. Your local PBS might prune dailies after two weeks, but the remote PBS might keep the same snapshots for a year. Garbage collection makes sure each server only clears what’s truly unreferenced on its own datastore. That separation is what allows you to run different retention strategies without breaking the archive.

The simplest habit is to run prune jobs every night and follow them immediately with garbage collection. That rhythm keeps storage healthy, predictable, and ready for the next backup cycle.

Best Practices That Actually Work

Designing the architecture is only half the battle. A multi-PBS environment will only deliver what you expect if it’s run with discipline. This is where many backup strategies fall down. The technology is solid, but the day-to-day habits don’t keep up.

One of the easiest wins is encryption. PBS supports client-side encryption, and there’s no excuse not to use it. Encrypt before data leaves your site, especially if it’s moving across a WAN link to another office or cloud location. That way, even if someone intercepts your sync traffic or gets access to a remote datastore, the data is useless without the keys.

Equally important is testing restores. Too many organisations find out their backups don’t actually work when it’s already too late. Don’t wait for a ransomware event to discover a datastore was misconfigured or a VM restore takes six hours instead of six minutes. Schedule regular restore drills from both local and remote PBS servers.

There are also some habits that work best as clear, repeatable rules of thumb:

• Separate credentials – Never reuse the same administrative account across PBS servers. If an attacker compromises one PBS, you don’t want them automatically walking into the second.
• Monitor datastore utilisation – A full datastore means backups stop dead. Watch usage closely and build alerts so you know about growth before it becomes a problem.
• Prune and garbage collect nightly – Run prune jobs to mark expired backups, then run garbage collection immediately after. This keeps datastores healthy and space available.
• Bandwidth shaping – If your sync traffic shares a WAN with production, set limits. A 2 a.m. sync should never disrupt the CEO’s 6 a.m. video call.

Finally, build operational consistency into your culture. If backup jobs, prune schedules, and restore tests run on the same night every week, the team will get used to checking results and following up on anomalies. That’s the difference between a theoretical backup plan and one that stands up under pressure.

A Fictional Case Study: Healthcare Provider in Queensland, Australia

This case study is fictional but based on real-world industry data.

A regional healthcare provider runs around 150 virtual machines in Proxmox VE across two data centres. Healthcare is one of the most targeted industries for ransomware. The ACSC reports that over sixty percent of providers globally have been attacked in the last two years. For this team, their old tape rotation and single NAS appliance simply weren’t cutting it. Recovery took too long, tapes weren’t tested, and penetration testing showed ransomware could wipe both production and backups in a single hit.

The team decided to modernise as part of a broader Proxmox migration. They deployed a local PBS with NVMe-backed ZFS in the primary site. Daily and weekly backups landed here, with retention set for two weeks of dailies and four weeklies. Restore times dropped from hours to minutes.

They then deployed a second PBS forty kilometres away in their secondary site. A nightly sync job kept it updated, and thanks to deduplication, the WAN link barely noticed. That remote PBS was configured for compliance: twelve monthlies and seven yearlies. Its prune and garbage collection jobs ran independently, protecting archives against accidental deletion.

The outcome was clear. The provider had fast local recovery, hardened offsite protection, compliance-friendly retention, and no more reliance on tapes. Ransomware drills showed the local site could be destroyed and they’d still recover from the remote PBS with separate credentials and encrypted data.

Proxmox Migration Needs Backup That’s Enterprise-Grade

Proxmox Backup Server is more than just a free add-on to Proxmox VE. When paired with a GFS strategy and deployed across multiple PBS instances, it delivers enterprise-grade backup at a fraction of the cost of legacy vendors. Sync jobs keep data flowing efficiently between local and remote servers. Garbage collection and pruning make sure storage stays healthy.

For organisations moving away from VMware, this model is proof that Proxmox migration doesn’t mean cutting corners on backup. And for Australian businesses in particular, it shows how you can design a strategy that delivers both resilience and cost effectiveness.

If you want help planning or implementing your own PBS architecture, Instelligence specialises in Proxmox Migration Services, Proxmox Backup Design, and ongoing Proxmox Support across Australia.