bump version to 7.3-1

[pve-docs.git] / pve-storage-pbs.adoc

diff --git a/pve-storage-pbs.adoc b/pve-storage-pbs.adoc
index c22f5b320cf6e59f78b97701a8340599302f23ae..1006a64099e87cd3605663e693d519129371d275 100644 (file)
--- a/pve-storage-pbs.adoc
+++ b/pve-storage-pbs.adoc
@@ -11,7 +11,7 @@ Storage pool type: `pbs`
 This backend allows direct integration of a Proxmox Backup Server into {pve}
 like any other storage.
 A Proxmox Backup storage can be added directly through the {pve} API, CLI or
-the webinterface.
+the web interface.
 
 Configuration
 ~~~~~~~~~~~~~
@@ -57,6 +57,13 @@ restricted to the root user.  Use the magic value `autogen` to automatically
 generate a new one using `proxmox-backup-client key create --kdf none <path>`.
 Optional.
 
+master-pubkey::
+
+A public RSA key used to encrypt the backup encryption key as part of the
+backup task. The encrypted copy will be appended to the backup and stored on
+the Proxmox Backup Server instance for recovery purposes.
+Optional, requires `encryption-key`.
+
 .Configuration Example (`/etc/pve/storage.cfg`)
 ----
 pbs: backup
@@ -64,7 +71,7 @@ pbs: backup
         server enya.proxmox.com
         content backup
         fingerprint 09:54:ef:..snip..:88:af:47:fe:4c:3b:cf:8b:26:88:0b:4e:3c:b2
-        maxfiles 0
+        prune-backups keep-all=1
         username archiver@pbs
 ----
 
@@ -75,7 +82,7 @@ Proxmox Backup Server only supports backups, they can be block-level or
 file-level based. {pve} uses block-level for virtual machines and file-level for
 container.
 
-.Storage features for backend `cifs`
+.Storage features for backend `pbs`
 [width="100%",cols="m,4*d",options="header"]
 |===============================================================
 |Content types |Image formats |Shared |Snapshots |Clones
@@ -116,6 +123,18 @@ a text file, for easy printing.
 # proxmox-backup-client key paperkey /etc/pve/priv/storage/<STORAGE-ID>.enc --output-format text > qrkey.txt
 ----
 
+Additionally, it is possible to use a single RSA master key pair for key
+recovery purposes: configure all clients doing encrypted backups to use a
+single public master key, and all subsequent encrypted backups will contain a
+RSA-encrypted copy of the used AES encryption key. The corresponding private
+master key allows recovering the AES key and decrypting the backup even if the
+client system is no longer available.
+
+WARNING: The same safe-keeping rules apply to the master key pair as to the
+regular encryption keys. Without a copy of the private key recovery is not
+possible! The `paperkey` command supports generating paper copies of private
+master keys for storage in a safe, physical location.
+
 Because the encryption is managed on the client side, you can use the same
 datastore on the server for unencrypted backups and encrypted backups, even
 if they are encrypted with different keys. However, deduplication between