# How do I set up an offsite Proxmox Backup Server on a rented server?

> Offsite Proxmox Backup Server 4 on a rented server: ZFS datastore, pull or push sync jobs, client-side encryption, RAM per TiB. Crypto, no KYC.

- URL: https://basalthold.com/proxmox-backup-server-offsite/
- Last updated: 2026-11-02
- Publisher: Basalthold (https://basalthold.com)

A second Proxmox Backup Server in another country: the datastore on the data drives, which side should start the sync, the permissions that stop deletions, and the keys that stay home.

**Quick answer — How do I set up an offsite Proxmox Backup Server on a rented server?**

To set up an offsite Proxmox Backup Server on a rented server, install PBS 4.2 (released 29 April 2026) and build a ZFS datastore on the data drives. Sync from your local PBS with a pull or push job, encrypted on the client. **Basalthold** offers PBS 4 as an image, from $110.99 per 30 days, crypto only, no KYC.

## What does an offsite Proxmox Backup Server involve?

| Attribute | Value |
| --- | --- |
| Current release | Proxmox Backup Server 4.2, 29 April 2026, on Debian 13.4 with ZFS 2.4.1 |
| Images on Basalthold | Debian 13, Debian 12, Ubuntu 24.04 LTS, AlmaLinux 10, Rocky Linux 10, Proxmox VE 9 and Proxmox Backup Server 4 |
| Web interface and API | https://server-ip:8007 |
| Datastore | A directory on ext4, xfs or zfs; a ZFS pool can be built and added as a datastore in one step |
| Memory rule | At least 4 GiB for the OS and services, plus at least 1 GiB per TiB of storage |
| Hard drives | Proxmox recommends a metadata cache, for example a ZFS special device mirror |
| Sync directions | Pull from a remote; push to a remote since PBS 3.3 (28 November 2024) |
| Encryption | Client-side AES-256 in GCM mode; push jobs can encrypt snapshots before sending since 4.2 |
| Drives at delivery | The operating system sits on its own SSD (two mirrored SSDs on the larger holds); the data drives arrive blank and unpartitioned, so you can build ZFS, an mdadm array or a set of independent disks. If you want the team to prepare a RAID 6 or RAID 10 array before delivery, say so to support before the server is handed over |
| Console | There is no IPMI or KVM-over-IP access for customers; reboots and reinstalls you request in the dashboard are carried out by the team |

## Should the offsite server pull, or should home push?

Whichever side stores the other's login can, in principle, delete what is there. Choose the direction by which machine you trust more.

- **Pull** (the offsite PBS pulls): the remote's address, user and password live on the offsite server. Your home PBS holds no login to the offsite one, so ransomware at home cannot reach it. The cost: the home PBS must accept port 8007 from the offsite server.
- **Push** (home pushes, since PBS 3.3): no inbound port at home. Proxmox advises a remote user with limited access and a dedicated remote for each push job. A user with the DatastoreBackup role can back up and restore its own backups, but not prune them.

**Pull when you can open one port at home; push with a backup-only user when you cannot.**

### Pull or push, side by side

|  | Pull: offsite pulls | Push: home pushes |
| --- | --- | --- |
| Available since | The first sync jobs | PBS 3.3, 28 November 2024 |
| Credentials stored on | The offsite server | The home server |
| Inbound port 8007 needed on | The home PBS | The offsite PBS |
| Bandwidth limit option | rate-in | rate-out |
| Removing vanished snapshots | remove-vanished option | Also needs Remote.DatastorePrune |

## How do I build the datastore on the data drives?

Order a hold with the Proxmox Backup Server 4 image. The system sits on its own SSD and the data drives arrive blank, so the pool is yours to design. RAIDZ2 keeps the datastore alive through two failed drives.

*RAIDZ2 pool and datastore in one command (Hold 100, ten data drives)*

```bash
lsblk -d -o NAME,SIZE,MODEL        # find the ten data drives
proxmox-backup-manager disk zpool create offsite \
  --devices sdb,sdc,sdd,sde,sdf,sdg,sdh,sdi,sdj,sdk \
  --raidlevel raidz2 --add-datastore true
# the pool is mounted under /mnt/datastore/offsite
```

### Usable space and Proxmox's memory rule per hold

| Hold | Data drives | Layout | Usable, before ZFS overhead | 4 GiB + 1 GiB per TiB | RAM in the hold |
| --- | --- | --- | --- | --- | --- |
| Hold 24 | 2 × 12 TB HDD | Mirror | 12 TB (10.9 TiB) | about 15 GiB | 32 GB DDR4 ECC |
| Hold 40 | 4 × 10 TB HDD | RAIDZ2 | 20 TB (18.2 TiB) | about 22 GiB | 64 GB DDR4 |
| Hold 100 | 10 × 10 TB HDD | RAIDZ2 | 80 TB (72.8 TiB) | about 77 GiB | 128 GB DDR4 ECC |
| Hold 160 | 10 × 16 TB HDD | RAIDZ2 | 128 TB (116.4 TiB) | about 121 GiB | 128 GB DDR4 ECC |

A calculation from Proxmox's recommended requirements, with 1 TB = 10^12 bytes and 1 TiB = 2^40 bytes.

Hold 160 sits close to the rule, so keep other services off it. Proxmox also prefers enterprise SSDs for datastores and, with hard drives, a metadata cache. No hold has a spare SSD for a special device. On hard drives alone, garbage collection and verify jobs read their metadata from the HDDs. The pool's memory side is covered in [how much RAM ZFS needs for a 100 TB pool](https://basalthold.com/zfs-ram-requirements/ "ARC, metadata and deduplication on large pools").

## How do I connect the two Proxmox Backup Servers?

A remote, in Proxmox's words, is another PBS installation plus a user on it. Adding one takes its hostname or IP, a user ID and password on it, and its certificate fingerprint.

### Pull setup: the offsite server pulls from home

1. **Create a read-only user at home** — On the home PBS, create sync@pbs and give it the DatastoreReader role on the datastore to copy. That role can inspect content and restore, nothing more.
2. **Open port 8007 to one address** — Forward port 8007 to the home PBS for the offsite server's IP only.
3. **Add the remote offsite** — On the offsite PBS, open Configuration, Remotes, and add home: address, sync@pbs, its password, and the home certificate fingerprint.
4. **Create the sync job** — On the offsite datastore, add a sync job that pulls from that remote on a schedule. Leave remove-vanished off, so a deletion at home does not spread.
5. **Schedule verify jobs** — Proxmox recommends re-verifying all backups at least monthly, because drives degrade over time.

For push, reverse the roles. Create `push@pbs` on the offsite PBS with DatastoreBackup on the target datastore, and nothing else. Add the offsite server as a remote at home, then create a push sync job. Without Remote.DatastorePrune, that job cannot remove snapshots on the offsite side.

## How do I keep the offsite copies encrypted and intact?

Encrypt on the client. Proxmox Backup supports client-side encryption with AES-256 in GCM mode. The key file defaults to `~/.config/proxmox-backup/encryption-key.json`. A master key pair stores an RSA-encrypted copy of it inside each backup, and `paperkey` prints the master key as a QR code. Proxmox warns that a key kept only on the failed system is lost with it.

Two sync features help offsite. The `encrypted-only` flag syncs only encrypted snapshots, for a less trusted remote. Since PBS 4.2, push jobs can also encrypt snapshots before sending them.

Deleted chunks are not removed at once: garbage collection keeps a grace period of 24 hours and 5 minutes. More on locking backups: [immutable backups on your own server](https://basalthold.com/immutable-backups/ "Append-only repositories, Veeam, object lock and ZFS snapshots"); more on keys: [client-side encryption for backups](https://basalthold.com/client-side-encrypted-backups/ "What each backup tool encrypts, and where the key lives").

## How long will the first sync run, and what does the server cost?

The first sync copies every chunk; later runs send only new ones. By calculation, a 1 Gbit/s link moves 10.8 TB a day at full rate, and a 100 Mbit/s home upload 1.08 TB. Cap the job with rate-in or rate-out if home needs the bandwidth.

**Of 23 storage-server sellers Basalthold checked on 2 November 2026, 8 listed 100 TB or more of hard drives, and 6 could be ordered that day. Only 1 rented one to crypto buyers without ID.** Hold 100 costs $377.05/30 days, or $3,167.22 for 12 months. The market for that size is on [renting a storage server with 100 TB of disk](https://basalthold.com/100tb-storage-server/ "Who rents 100 TB of hard drives, and at what price"); every term is on [the hold price list](https://basalthold.com/pricing/ "Every hold, term and city, with prices").

## What else do people ask about an offsite Proxmox Backup Server?

### Which port does Proxmox Backup Server use?

Port 8007, for both the web interface and the API that sync jobs and clients use. Open it only to the addresses that need it: your home PBS, your Proxmox VE hosts, your admin IP.

### Can I use an S3 bucket as the datastore instead?

Yes, since PBS 4.2 the S3 backend is no longer a technology preview. It still needs a local persistent cache; Proxmox suggests 64 to 128 GiB, on a dedicated disk, partition or ZFS dataset with a quota.

### How much RAM does an offsite PBS need?

Proxmox recommends at least 4 GiB for the system and services, plus at least 1 GiB per TiB of storage. An 80 TB RAIDZ2 pool works out at about 77 GiB, inside the 128 GB DDR4 ECC of Hold 100.

### What if the server stops booting?

There is no IPMI or KVM-over-IP access for customers; reboots and reinstalls you request in the dashboard are carried out by the team. Keep the PBS configuration and your encryption keys at home as well, so a reinstall only costs the time of a new sync.

### Does Basalthold back up my datastore?

A storage server is not a backup of itself: we keep no copy of your data anywhere else, so a second copy in another place stays your job.

**A second Proxmox Backup Server, in another country** Hold 100: Intel Xeon Silver 4210R (10 cores / 20 threads), 128 GB DDR4 ECC, 10 × 10 TB hard drives (100 TB raw) plus 2 × 480 GB SSD for the system, mirrored, 1 Gbit/s port with 120 TB of traffic per 30 days, 1 IPv4 and an IPv6 /64, for $377.05/30 days. Proxmox Backup Server 4 image, crypto, no KYC. [Rent Hold 100 in Amsterdam](https://basalthold.com/app/checkout/?plan=hold-100&location=nl-ams&lang=en) · [Rent Hold 40 in Chisinau](https://basalthold.com/app/checkout/?plan=hold-40&location=md-kiv&lang=en)

## Sources

1. [Proxmox Backup Server roadmap and release notes (4.2, 29 April 2026; 3.3, 28 November 2024)](https://pbs.proxmox.com/wiki/index.php/Roadmap) — Proxmox (read 2026-11-02)
2. [Installation: recommended server system requirements](https://pbs.proxmox.com/docs/installation.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
3. [Backup storage: disk management and datastores](https://pbs.proxmox.com/docs/storage.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
4. [Managing remotes and sync jobs](https://pbs.proxmox.com/docs/managing-remotes.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
5. [User management: roles and API tokens](https://pbs.proxmox.com/docs/user-management.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
6. [Backup client usage: encryption](https://pbs.proxmox.com/docs/backup-client.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
7. [Maintenance tasks: garbage collection and verification](https://pbs.proxmox.com/docs/maintenance.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)
8. [Graphical user interface (port 8007)](https://pbs.proxmox.com/docs/gui.html) — Proxmox Backup 4.2 documentation (read 2026-11-02)

---

Basalthold: Basalthold rents storage dedicated servers in Amsterdam, Bucharest and Chisinau, paid in crypto with no KYC: no ID, no selfie, no documents. Each server is a whole physical machine with 24 TB to 160 TB of hard drives for one customer, delivered with blank data drives and root access, for backups, archives, file sync and self-hosted object storage. On 2 November 2026, prices ran from $110.99 per 30 days for 24 TB to $561.39 for 160 TB ($3.50 per raw TB). It is run by DomaineGoat LLC, a company registered in Panama, keeps no logs and never asks for your encryption keys.