Layered Backup Strategy

Part of FSJ-LAB.

Goal

No single backup tool covers everything well. I wanted three layers: whole-VM snapshots for fast rollback, file-level backups for granular restores, and version-controlled network configs so I can see exactly what changed and when.

What I built

• VM snapshots. Proxmox vzdump backs up every VM weekly to an NFS share on the Synology NAS.
• File-level backups. A Bacula director, storage daemon, and clients on a dedicated backup VM. Four VMs are enrolled, each with a FileSet tailored to its role, plus a standard include pattern so new clients drop in cleanly and a dedicated restore path.
• Network config versioning. RANCID pulls configs from the switches and the FortiGate every 30 minutes. I migrated it from CVS to Git, then served the repo over HTTP with nginx and fcgiwrap so LibreNMS can show config history next to each device.

What I learned

• Check what a backup actually contains. Two VMs had backups far smaller than their data disks, which meant those disks were either nearly empty or excluded. A backup you haven’t inspected is an assumption.
• Git is a great backend for anything that’s text and changes over time, including network configs.
• A restore path planned in advance is part of the backup, not an extra.

Next steps

• Automated backup verification through n8n
• Confirm coverage of large data disks before relying on snapshots for HA migration