Linux server · restic / rsync

Move your Linux server backups offsite

Keep your sysadmin tooling. restic encrypts and deduplicates on your own server, then writes over SFTP or S3 to the Nimbus Backup Gateway — or use rsync for mirroring. Downstream, PBS (Primary → AirGap → LTO) keeps an immutable copy beyond the reach of ransomware.

Request a quote 15-min tech call

restic → SFTP restic / rclone → S3 rsync (SSH/daemon) Dedicated VPN Multi-PBS AirGap LTO

Your restic and rsync jobs, to a truly offsite target

The Gateway exposes standard transport protocols — SFTP, S3, rsync, plus FTP/WebDAV via rclone or Duplicati. You don't change your scripts: your cron or systemd timer simply writes to a hosted, supervised target protected by Nimbus, instead of a second server you'd have to manage yourself. Not sure which method fits? See the guide on choosing the right backup method, or compare every path in the protocols matrix. The server hosts a database, or you also run a Synology NAS? See offsite database backup or offsite backup for a Synology NAS.

Which protocol for a Linux server?

Two good choices depending on your goal: a versioned, deduplicated and encrypted repository, or a file mirror. Prefer Proxmox Backup Server's native client? See proxmox-backup-client on Linux; on RHEL, Rocky, Alma, Fedora, Arch or Alpine, it installs from our unofficial proxmox-backup-client repository.

Recommended

restic → SFTP (or S3)

Deduplication and encryption on your own server, before sending. The Gateway only stores encrypted blocks whose key you keep. S3 is possible via restic or rclone to the Gateway's object target.

Versioned history + dedup
Application-level AES-256 encryption
Reduced transferred volume
No binary to install on the Gateway

rsync (SSH or daemon)

For a simple, readable file mirror, resynced incrementally. rsync preserves the versioning and dedup already present at the source. Ideal for /home, /srv, application shares.

File-by-file mirror
Fast resync
Files directly readable on the target
FTP/WebDAV possible via rclone / Duplicati

Borg (ssh://) and restic REST mode: not supported

Both modes require their server binary (Borg daemon, rest-server) to be installed on the Gateway, which is not the case: the Gateway only exposes standard transport protocols. The good news: you keep all of restic's deduplication and encryption by simply using it in SFTP or S3 mode — the repository stays managed client-side, and the Gateway only sees encrypted blocks.

How it works, step by step

Four steps, without changing your Linux backup scripts.

Dedicated VPN, zero inbound port

We set up an encrypted tunnel (WireGuard or OpenVPN) between your server and the Gateway. In client mode, the server initiates the outbound tunnel: nothing is exposed in clear on the internet.

restic encrypts + deduplicates at source

Your restic job (cron / systemd timer) deduplicates and encrypts the repository locally, then writes to the Gateway's SFTP or S3. Mirror variant: rsync over SSH or daemon to the Gateway.

Nimbus replicates multi-PBS + AirGap

The Gateway buffers what it receives, then Nimbus protects it to a Primary PBS — and optionally a Secondary PBS, a disconnected AirGap PBS and LTO tape in a vault. Retention and immutability on the PBS side.

Restore test

We validate a real restore (restic restore or rsync resync) from the Nimbus chain to guarantee your Linux servers are recoverable, then sign off go-live.

From your Linux server to the air-gap

The Gateway multiplexes your non-Proxmox sources. A single backup can be replicated to several PBS, then archived to tape, depending on your PBS plan.

Linux server (restic / rsync)

Nimbus Backup Gateway

Primary PBS

AirGap PBSoptional

LTO tape in vaultoptional

Multi-PBS architectures (France, Europe, AirGap) are detailed on the PBS plans and AirGap PBS pages. Your Proxmox VMs go PVE → PBS direct, without passing through the Gateway. To gauge how long the first restic or rsync run will take, estimate your backup window.

Plans and pricing

Gateway Cloud starts at 150EUR excl. tax/month (2 TB included); the full breakdown of plans (Cloud, Appliance, antivirus scan option, setup) and pricing is centralized on the hub.

See plans and pricing on the hub

What the Gateway is for

One clear purpose: receiving and protecting your Linux server backups, nothing else.

Depositing and protecting your restic / rsync jobs

Your Linux backups land here, then protected to PBS.

Optionally exporting them to the more advanced Nimbus Backup services

Multi-PBS replication, AirGap PBS and LTO archiving, depending on your plan.

It is not designed to host live production data or to serve as application hosting: it is a backup ingestion gateway, not a file server.

Go further

Offsite backup hub

The Gateway, its protocols and all offers.

Databases

PostgreSQL, MySQL, MariaDB, SQL Server: dump → transport.

Protocols matrix

Compare rsync, SFTP, S3, WebDAV by source.

Choose your method

The Proxmox / Gateway / Client decision guide.

PBS plans

The Nimbus Proxmox Backup Server plans.

AirGap PBS

A disconnected, out-of-reach copy.

Linux server FAQ

For most Linux servers, restic to SFTP or S3 is recommended: restic deduplicates and encrypts on your own server, before anything is sent, which cuts the transferred volume and stores encrypted blocks on the Gateway. If you'd rather have a file-by-file mirror (for example a synchronized /home or /srv), rsync over SSH or daemon fits better. The Gateway ingests both.

Because Borg (ssh://) and restic REST mode require their server binary to be installed on the target — here the Gateway. The Gateway exposes standard transport protocols (SFTP, S3, rsync, WebDAV) but does not host the Borg daemon or rest-server. Use restic in SFTP or S3 mode (the restic repository is then managed client-side, the Gateway only sees blocks), or rsync. You keep restic dedup and encryption without installing anything on the Gateway.

Yes. restic encrypts the repository on your own server (AES-256), before any upload: the Gateway, and therefore Nimbus, only store encrypted blocks whose key stays with you. The transport is also wrapped inside the dedicated VPN. Keep the restic repository key / password safe: without it, no one — not even Nimbus — can restore the data.

restic → SFTP/S3 when you want versioned history, deduplication and built-in application-level encryption: ideal for application servers and large, frequently changing folders. rsync when you want a simple, readable file mirror (fast resync, direct file access on the target). rsync preserves the versioning and dedup already present at the source. Both end up protected by the same PBS chain.

No. The restic or rsync job, launched by cron/systemd timer on your server, writes to the Gateway over a dedicated VPN (WireGuard or OpenVPN). In client mode, your server opens an outbound tunnel to Nimbus: no inbound port to open on your firewall, and the Gateway never exposes SFTP/S3 in clear on the internet.

Yes. A single Gateway multiplexes several non-Proxmox sources — several Linux servers, NAS units, database dumps — each with its own protocol, inside the dedicated VPN tunnel. Capacity is sized on the total working set. If you also back up Proxmox VMs, they go PVE → PBS direct, without passing through the Gateway.

Take your Linux servers offsite with confidence

We plug restic or rsync into the Gateway, protect to PBS and validate a restore. 15-minute tech call, no commitment.

Request a quote Schedule a call

Complete your infrastructure

Managed Proxmox VE

High-availability hosting for your Proxmox VMs in a French datacenter

24/7 Server Management

Monitoring, maintenance and on-call support for your infrastructure