> ## Documentation Index
> Fetch the complete documentation index at: https://doc.khcolo.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Cloud Backup Strategy for Cambodia — 3-2-1 Rule Guide
> Implement the 3-2-1 backup rule for your Cambodia cloud environment — covering Veeam, Proxmox Backup Server, AWS S3, Wasabi, and weekly/daily schedules.
A backup that has never been tested is not a backup — it is a hope. Many Cambodian businesses discover the reliability of their backup strategy only at the worst possible moment: during a ransomware incident, a hardware failure, or a misconfigured update that corrupts production data. This guide gives you a practical, layered backup strategy built around the industry-standard 3-2-1 rule, paired with the specific tools and cloud storage targets that work well in the Cambodia and Southeast Asia context.
## The 3-2-1 Rule Explained
The 3-2-1 rule is the foundational framework for resilient data protection. It defines the minimum structural requirements that ensure your backups can survive any single category of failure — hardware fault, site disaster, or ransomware encryption.
Maintain **3 total copies** of every critical dataset: 1 production copy and 2 backup copies. If you only have 1 backup and it fails, you have nothing.
Store your backups on **2 different physical media types** — for example, a local server (internal disk) and a network NAS. Relying on a single media type means one hardware category failure wipes all copies.
Keep **at least 1 copy offsite** in secure cloud storage. An onsite disaster — fire, flood, theft, or power surge — cannot reach an offsite copy.
For 3CX phone systems, "critical data" includes: your 3CX configuration backup (extensions, trunks, IVR, call queues), active call recordings, voicemail messages, and the SQL database that stores CDR (call detail records).
## Backup Architecture Overview
A well-structured backup topology for a KHCOLO cloud deployment looks like this:
| Layer | What Is Backed Up | Where It Lives | Tool |
| ------------------------ | ----------------------------------------- | ---------------------------------------- | ------------------------------------ |
| **Local VM snapshot** | Full VM disk image | Same cloud node (different volume) | Proxmox Backup Server / Veeam |
| **Network NAS backup** | VM backup + database dumps | Network-attached storage (LAN or DC NAS) | Proxmox Backup Server / Acronis |
| **Offsite cloud backup** | DB dumps, call recordings, config exports | S3-compatible object storage | Rclone / Acronis Cloud / Veeam Cloud |
This three-layer structure maps directly onto the 3-2-1 rule: the live VM is copy 1, the local snapshot is copy 2, and the offsite cloud is copy 3.
## Backup Tools
**Proxmox Backup Server (PBS)** is an open-source, enterprise-grade backup solution designed specifically for Proxmox VE environments. It provides deduplicated, incremental backups of KVM VMs and LXC containers.
**Key capabilities:**
* Incremental client-side deduplication (dramatically reduces storage usage and backup duration)
* AES-256 encryption at rest and in transit
* Catalogue-based restore — restore individual files or entire VMs
* Integrated with the Proxmox VE web UI (schedule backups directly from the cluster GUI)
* Open-source, free to use
**Best for:** Any organisation running Proxmox VE. PBS is the natural first choice for local and NAS-based VM backups.
Deploy PBS on a dedicated VM or physical node — never on the same host as the VMs you are backing up. If the host fails, you need to be able to recover from PBS independently.
**Veeam Backup & Replication** is the market-leading enterprise backup platform, supporting VMware vSphere, Hyper-V, and physical server environments.
**Key capabilities:**
* Instant VM Recovery — spin up a failed VM directly from the backup repository in minutes
* SureBackup automated recovery verification (boots backup in isolated network and runs tests)
* Replication to secondary site or cloud (Veeam Cloud Connect)
* Broad OS and application support: Exchange, SQL Server, Active Directory, SAP
* Centrally managed via Veeam Backup & Replication console
**Best for:** VMware vSphere environments and enterprises with heterogeneous infrastructure (mixed Windows/Linux workloads, physical servers).
**Acronis Cyber Protect** combines backup, disaster recovery, and security into a single agent-based platform.
**Key capabilities:**
* Agent-based backups for physical and virtual servers
* Acronis Cloud storage integration (globally distributed)
* Anti-ransomware protection built into the backup agent
* Granular restore: individual files, emails, databases
* Web-based management console — suitable for MSPs and multi-tenant deployments
**Best for:** Mixed environments (physical + virtual), businesses that want a single-vendor backup + endpoint security solution, and organisations that prefer a managed cloud backup target without operating their own S3 bucket.
## Cloud Storage Targets
For your offsite copy, choose an S3-compatible object storage provider that offers competitive egress pricing and geographic proximity.
| Provider | Storage Cost (approx.) | Egress Cost | Best For |
| ---------------------- | ----------------------- | ----------- | ---------------------------------------------------------------- |
| **AWS S3 (Singapore)** | \~\$0.023 / GB / month | \$0.09 / GB | Low-latency access from Singapore DC; AWS ecosystem integrations |
| **Backblaze B2** | \~\$0.006 / GB / month | \$0.01 / GB | Cost-sensitive offsite backups; excellent price-performance |
| **Wasabi** | \~\$0.0068 / GB / month | Free egress | High-volume archives; no egress fees simplify cost modelling |
All three providers expose an S3-compatible API, which means tools like Rclone, Veeam, Proxmox Backup Server, and Acronis can write directly to any of them without custom connectors. Backblaze B2 and Wasabi offer significantly lower storage and egress costs than AWS S3 — a meaningful saving for organisations storing large volumes of call recordings.
## Backup Schedule
A two-tier schedule — weekly full backups plus daily incrementals — balances recovery-point granularity with storage consumption.
Run incremental VM snapshots and database exports every day during a low-traffic window (e.g., 02:00–04:00 local time). Incrementals capture only the blocks that changed since the last backup, making them fast and storage-efficient.
**What to back up daily:**
* [ ] VM incremental snapshot (PBS / Veeam)
* [ ] MySQL / PostgreSQL database dump (`mysqldump`, `pg_dump`)
* [ ] 3CX configuration export (via 3CX Management Console scheduled backup)
* [ ] Call recordings sync to offsite S3 bucket (Rclone incremental sync)
**Retention:** Keep 7 daily snapshots (rolling 7-day window).
Run a full VM backup once per week to create a clean, self-contained restore point. Full backups take longer and use more storage, but they eliminate dependency chains that can complicate incremental restore chains.
**What to back up weekly:**
* [ ] Full VM backup for all production servers
* [ ] Full database dump with schema and all tables
* [ ] Archive of call recordings for the preceding 7 days to offsite storage
* [ ] Export of any IaC/configuration-as-code (Ansible playbooks, Terraform state)
**Retention:** Keep 4 weekly full backups (rolling 28-day window).
For compliance, audit, or long-term recovery purposes, retain at least one monthly full backup on cold or archival storage with a retention period of 12 months or more.
**Storage options for archival:**
* AWS S3 Glacier Instant Retrieval
* Backblaze B2 (lifecycle rules to cold storage)
* Wasabi (no egress fees make retrieval cost-predictable)
## Recovery Testing
**An untested backup is not a backup.** Backup files can become corrupted, storage targets can silently fail, and restore procedures can have undocumented dependencies. If you have never successfully restored from a backup, you do not know whether your backup strategy works. Schedule a restore test — to an isolated environment — at least once per quarter.
A basic quarterly restore test should verify:
* [ ] VM restored from weekly full backup and boots cleanly
* [ ] Database restored and passes row-count integrity check
* [ ] 3CX configuration restored and extensions register correctly in test environment
* [ ] Call recordings accessible and playable from restored archive
* [ ] Document the time taken for each restore step (this becomes your RTO baseline)
Use Proxmox's snapshot restore or Veeam's SureBackup isolated lab feature to run recovery tests without risking your production environment. Document the result — pass or fail — in a recovery test log and share it with your IT manager or auditor.
## Summary
| Rule Component | Implementation |
| ------------------- | ------------------------------------------------------- |
| **3 copies** | Production VM + local snapshot (PBS/Veeam) + offsite S3 |
| **2 media types** | Local cloud volume + S3-compatible object storage |
| **1 offsite copy** | AWS S3 (Singapore), Backblaze B2, or Wasabi |
| **Daily schedule** | Incremental VM snapshot + DB dump + call recording sync |
| **Weekly schedule** | Full VM backup + full DB dump |
| **Recovery test** | Quarterly restore to isolated environment |
For assistance configuring Proxmox Backup Server, S3 offsite sync, or a managed backup service, contact KHCOLO's technical team. We can design and implement a backup architecture that meets your RTO/RPO targets and fits your storage budget.