Your Proxmox backup job probably skips the guests you built after you made it. Here's the 3-2-1 setup that doesn't
Description and use
Implemented a comprehensive 3‑2‑1 backup strategy that protects all VMs, retains multiple backup layers, encrypts data, and alerts on failures or missed runs.
Problem
A Proxmox backup job created for selected VMs omitted newly created guests, protecting the wrong data.
Outcome
Implemented a comprehensive 3‑2‑1 backup strategy that protects all VMs, retains multiple backup layers, encrypts data, and alerts on failures or missed runs.
Workflow
- Configure backup job to select All VMs and exclude scratch guests
- Set mode to snapshot, compression to ZSTD, schedule nightly
- Define retention using keep-last, keep-daily, keep-weekly, keep-monthly
- Add notification via notification system
- Create NFS storage on NAS and add to Proxmox
- Install qemu-guest-agent in each VM
- Add bandwidth limit if needed
- Set up Proxmox Backup Server with datastore, user, ACL, and encryption key
- Copy PBS encryption key to a secure location
- Schedule PBS prune, garbage collection, and verify jobs
- Configure rclone with raw and crypt remotes, set sync command and bandwidth limits
- Set lifecycle rule on bucket and use rclone copy for irreplaceable data
- Add vzdump hook script to ping healthchecks.io or Uptime Kuma
- Create weekly script to flag stale or missing backups
Evidence
I ran a Proxmox homelab for years with a backup job that reported success every night. It had been created for "selected VMs" and every guest I built after that was simply not in the list.
Selection mode: All, with your scratch guests under Exclude. New guests are protected the day they are created.
Put the archives on something that is not the host's own disk. An NFS export on the NAS is the simplest:
Install the QEMU guest agent in every VM (apt install qemu-guest-agent, enable it in the VM's Options). With it, snapshot mode asks the guest to flush its filesystems first, which is the difference between a consistent backup and one that needs fsck on restore.
vzdump copies the whole guest every night. PBS splits every disk into chunks, stores each unique chunk once, and after the first run only ships what changed.
That last line encrypts every chunk on the client before it leaves the node, and writes the key to /etc/pve/priv/storage/pbs01.enc. Copy that key somewhere that is not this cluster
rclone config # n) name: b2raw, type: b2, paste the key ID and key (scoped to one bucket) # n) name: b2, type: crypt, remote: b2raw:homelab-backups, two passwords
vzdump has hook scripts for exactly this. In /etc/vzdump.conf: script: /usr/local/bin/vzdump-hook.sh
- Record date: 2026-10-10T01:41:07.858Z