Move your database backups offsite
A database isn't backed up over the network: you take a local dump, then ship it over SFTP or rsync to the Nimbus Backup Gateway, which protects the history with Proxmox Backup Server (Primary PBS → AirGap → LTO). Offsite dumps, immutable and out of a ransomware's reach.
The "local dump → transport" pattern
A database engine exposes no backup network protocol: it serves SQL queries, not files. The right method is two steps: your server produces a consistent dump locally (for MySQL and MariaDB, see the mysqldump / mariadb-dump guide), then that file is shipped over SFTP or rsync to the Gateway, inside a dedicated VPN. It's the dump — not the database — that goes offsite. Not sure which method fits? See the guide choose the right backup method. If it is the engine itself you want to hand over rather than its dumps, RDEM also runs managed MariaDB.
PostgreSQL
pg_dump / pg_dumpall
MySQL
mysqldump
MariaDB
mariadb-dump
SQL Server
BACKUP DATABASE / TO URL
Oracle
Data Pump (expdp)
MariaDB / MySQL: a more direct method, no Gateway
For MariaDB and MySQL, we tested and chose a more elegant method than shipping files: one dump per database, sent straight to a Proxmox Backup Server datastore with proxmox-backup-client, plus binlogs every 5 minutes to go back to just before a mistake. No SFTP, no Gateway: the client talks to PBS natively.
- Deduplication at upload: 98.6% on the 2nd pass, one hour after the 1st, in our bench (uncompressed dumps, pxar archive); 24-hour measurements in progress.
- Point-in-time recovery by replaying binlogs, validated in our bench.
- Client-side encryption, which we recommend: if you enable it, the key stays with you.
- Proxmox's official package on Debian; on Ubuntu, its static package, from its repository or ours; RHEL, Rocky, Alma, Fedora, Arch and Alpine through our unofficial repository.
For PostgreSQL, SQL Server, Oracle, or if you only want to install an SFTP client, the dump → Gateway pattern described below remains the universal path.
How it works, step by step
Four steps, from dump to vault, without exposing your database engine.
Consistent local dump
Your server produces a point-in-time dump: pg_dump / pg_dumpall (PostgreSQL), mysqldump or mariadb-dump (MySQL/MariaDB), BACKUP DATABASE (SQL Server), Data Pump (Oracle). The engine stays local, never exposed to the internet.
Dedicated VPN
An encrypted tunnel (WireGuard or OpenVPN) links your server to the Gateway. No inbound port to open: your server initiates the outbound tunnel, nothing is exposed in clear on the internet.
SFTP or rsync transport of the dump
The dump file is shipped to the Gateway over SFTP (easy to script after the dump) or rsync (ships only new dumps). FTPS, SMB or an S3 endpoint via MinIO are also available.
Nimbus protects to PBS + AirGap
The Gateway ingests the dump, then Nimbus replicates it to a Primary PBS — and optionally a disconnected AirGap PBS and LTO tape in a vault. PBS provides versioning, deduplication and immutability of the history.
To compare SFTP, rsync, FTPS, SMB and S3 by source, see the backup protocols matrix. Do your dumps land on a NAS? See offsite backup for a QNAP NAS or offsite TrueNAS backup.
SFTP or rsync for your dumps?
Both run inside the dedicated VPN and are ingested by the Gateway. The choice depends on your dump rotation.
SFTP
The simplest to chain after the dump: one line in your post-dump script pushes today's file. Ideal when each dump is a new standalone (timestamped) file.
- Trivial post-dump scripting
- One dump file = one transfer
- Works with cron / scheduled task
rsync
Handy if you keep a rotating dumps directory: rsync ships only what changed, cutting the transfer window on a constrained link.
- Ships only new dumps
- Good on constrained links
- Keeps a mirrored directory
An S3-compatible object endpoint (via MinIO on the Gateway) is also possible — for example SQL Server 2022 BACKUP TO URL or an rclone client — but SFTP or rsync stay the most direct path for a dump file.
From dump to air-gap
Once the dump is ingested, it can be replicated to several PBS, then archived to tape. You compose the chain to match your PBS plan.
Multi-PBS architectures (France, Europe, AirGap) are detailed on the PBS plans and AirGap PBS pages. Why two sites? See the OVH Strasbourg fire case study.
Gateway Cloud pricing for your dumps
The simplest path to move database dumps offsite: the Cloud Gateway, hosted and supervised by Nimbus. Prices excl. tax.
Cloud Gateway
2 TB included
- Dedicated VM + dedicated VPN
- 2 TB included, +15EUR/TB
- SFTP / FTPS / SMB / rsync / S3 (MinIO)
- 99EUR setup
Full pricing on the hub
Cloud and Appliance offers, full price grid, antivirus scan option and setup: it's all centralised on the hub, so the information isn't duplicated.
See the offsite NAS backup hub for the offers and the protocols matrix for the transport paths.
For the big picture and offsite backup pricing, see the business page.
Let PBS manage the dump history
On the server side, keep a short local rotation (today's dump, maybe a few days). It's Proxmox Backup Server that owns the long history offsite:
Under managed plans, Nimbus can write and supervise the dump + transport script (Linux cron, Windows scheduled task or SQL Server Agent), set up the VPN and validate an end-to-end restore.
Without a Gateway, the dump can also go straight to a PBS datastore with proxmox-backup-client, installed from our repository of signed packages on RHEL, Rocky, Alma or Fedora (Proxmox's official package on Debian, static package on Ubuntu): that's the method we chose for MariaDB / MySQL.
Go further
Offsite NAS hub
The Gateway, its protocols and all the offers.
Protocols matrix
SFTP, rsync, FTPS, SMB, S3 by source.
Choose your method
The Proxmox / Gateway / Client decision guide.
QNAP / HBS 3
Offsite backup for a QNAP NAS with HBS 3.
Offsite TrueNAS
Rsync Task / Cloud Sync for TrueNAS.
AirGap PBS
A disconnected copy, out of reach.
Frequently asked questions — databases
Move your dumps offsite with confidence
We wire your dump to the Gateway over SFTP or rsync, protect the history on PBS and validate a restore. A 15-minute technical chat, no strings attached.