← zabolotny.de
DEENRUUA

Home / Notes

Homelab · Backup · Proxmox

Backup the 3-2-1 way and the restore test: a backup only counts once it has been restored

Most backup stories end at the same point: the backup ran – but nobody ever tested whether it can be restored. Here is how I back up my Proxmox host and how I test the restore without endangering anything running.

Serge Zabolotny ·

The 3-2-1 rule in one sentence

Three copies of the data (the original plus two backups), on two different storage media, with one in a different location. A second disk in the same machine protects against a disk failure, but not against theft, fire or a power surge – which is exactly the gap the last number closes. How the series covers this is in access and backups in the home server.

My baseline: vzdump with a retention rule

On the Proxmox host with the split LXC containers, a backup runs daily to a separate disk, keeping seven daily, four weekly and three monthly copies:

vzdump <CTID> --storage <backup-storage> --mode snapshot \
  --prune-backups keep-daily=7,keep-weekly=4,keep-monthly=3

In addition, Uptime Kuma reports when a service goes down. That does not replace a restore test, but it quickly shows when something is wrong. I secure access to the host as described in zero trust for the homelab.

The restore test in four steps

Safety rule: always restore to a new, unused container ID, never to the ID of a running container. And remove the test container’s network before starting it so it cannot clash with the original.

  1. Pick a backup: list the archives in the backup storage and choose a recent one.
  2. Restore to a new ID: pct restore 999 <archive> --storage <target-storage>
  3. Remove network, start, check: pct set 999 -delete net0, then pct start 999. Does the service run? Is the data complete and recent?
  4. Clean up and note it down: pct stop 999 && pct destroy 999. Record the date, archive and result – that is your evidence.

For virtual machines the command is qmrestore; the principle stays the same. Repeat the test at fixed intervals, say once a quarter, and after every major change to the setup.

Why this matters professionally too

Backup and recovery are among the measures customers may ask service providers about under NIS2. A documented restore test is concrete evidence. For me it is also one of the things that should be a given in every project, from MeisterMeld to the server environment.

Checklist

Keep reading

Regulation · IT security · SMEs

NIS2 for small IT companies and freelancers: thresholds, deadlines, duties

The German NIS2 implementation act has been in force since 6 December 2025. Whether a company is directly affected depends on sector and size – but small firms feel it as suppliers too.

Access · Security · Backup

Reaching and protecting a home server: Tailscale, Cloudflare Tunnel, vzdump

A home server is only as good as its access and its backups. My principle: no port forwarding, every access path a conscious decision, a backup every day.

Proxmox · LXC · Homelab

Proxmox & LXC in a homelab: which containers I run and why

Four containers, four roles: how my home server is built, which programs run where and how I laid out the storage.

Self-hosting · Homelab · Privacy

Leaving the cloud: a home server instead of Google, iCloud & co.

At home I run a Proxmox server with 15+ services. Here is which cloud services it replaces for me, what it costs – in time – and where you are better off staying in the cloud.

Comments

Join the discussion: comments run on GitHub Discussions (sign in with a GitHub account). Content from GitHub/giscus is only loaded after you click. Privacy

More from practice

Find more notes, case studies and projects on the homepage.

All notes Case study MeisterMeld Case study PflegeOasis Case study Kernbohr-Expert Back to the homepage