S3-compatible · Cloud Sync Task & rclone

TrueNAS S3 Backup in Frankfurt

ZFS snapshots stay local, the cheap off-site copy lands GDPR-compliant in German object storage. Via Cloud Sync Task (GUI) or rclone against endpoint https://de-fra.i3storage.com, region de-fra. 1 TB egress included per TB, from €2.49/TB.

Preskusite brezplačno Vprašajte nas neposredno

shell — truenas

# TrueNAS Cloud Sync → S3 (Custom Provider)
# Credentials: Endpoint https://de-fra.i3storage.com | Region de-fra
rclone sync /mnt/tank/data intercolo:truenas-offsite \
  --s3-endpoint https://de-fra.i3storage.com \
  --s3-region de-fra --checksum --transfers 8 --progress
Transferred:   1.2 TiB / 1.2 TiB, 100%

ZFS + S3

Cloud Sync Task

GDPR / DPA

Frankfurt DC

1 TB Egress

incl. per TB

For TrueNAS homelabbers & SMBs

ZFS locally, the distance copy in Frankfurt

ZFS gives you snapshots, replication, scrubs and end-to-end checksums locally — but a snapshot on the same pool (or even a second NAS in the same room) is not an off-site backup. Object storage in Frankfurt is the cheap third leg: intercolo i3 is S3-compatible, strong read-after-write, reached via the endpoint https://de-fra.i3storage.com in region de-fra, at 99.999999% durability — and the data never leaves the Frankfurt facility. You push your datasets as objects off-site, either comfortably through a TrueNAS Cloud Sync Task in the GUI or scriptably via rclone. No second site, no tape robots, no US hyperscaler egress surprises.

Set up a Cloud Sync Task in the TrueNAS GUI

Create a cloud credential

In TrueNAS SCALE: Credentials → Backup Credentials → Cloud Credentials → Add (in CORE: System → Cloud Credentials). Pick 'S3 Compatible' as the provider — only that type lets you set a custom endpoint instead of a hard-wired Amazon region name.

Enter endpoint, region & keys

Endpoint URL: de-fra.i3storage.com · Region: de-fra · Access Key ID + Secret Access Key from your intercolo API-key pair (SigV4). Via 'Verify Credentials' TrueNAS tests the connection immediately. TLS stays on and the certificate is valid.

Add the Cloud Sync Task

In SCALE: Data Protection → Cloud Sync Tasks → Add (in CORE: Tasks → Cloud Sync Tasks). Give it a description, select the credential you just created and pick the bucket (e.g. truenas-offsite) — optionally a subfolder per dataset.

Set direction & transfer mode

Direction: PUSH (local → S3). Transfer Mode: SYNC mirrors the source exactly and also deletes removed files remotely; COPY only adds and never deletes in the bucket. Choose the dataset path as the source, e.g. /mnt/tank/data.

Define the schedule

Set the schedule or cron, ideally nightly right after the local snapshot task so a consistent state is uploaded. Optionally set a bandwidth limit and enable 'Follow Symlinks' as needed.

Enable Remote Encryption (optional)

Tick 'Remote Encryption' and filenames and contents are encrypted client-side via rclone crypt BEFORE upload. Store the password and salt safely — without them the off-site copy cannot be restored later.

rclone alternative: config create + sync

bash

# 1) Create a remote against the intercolo endpoint (S3 Compatible):
rclone config create intercolo s3 \
    provider Other \
    access_key_id <ACCESS_KEY> \
    secret_access_key <SECRET_KEY> \
    endpoint https://de-fra.i3storage.com \
    region de-fra

# 2) Create the bucket and push the dataset:
rclone mkdir intercolo:truenas-offsite
rclone sync /mnt/tank/data intercolo:truenas-offsite \
    --checksum --transfers 8 --progress

# 3) Optionally encrypt client-side (rclone crypt before upload):
rclone config create secure crypt \
    remote intercolo:truenas-offsite \
    password <PASSWORD>
rclone sync /mnt/tank/data secure: --checksum --progress

Path-style: https://de-fra.i3storage.com/truenas-offsite · Virtual-hosted: https://truenas-offsite.de-fra.i3storage.com. Both work; --checksum compares by checksum instead of timestamp — a natural fit for ZFS.

Two jobs, clearly separated

ZFS replication protects against failure, off-site S3 against site loss

Keep the roles cleanly separated. Local ZFS snapshots and replication to a second pool or NAS give you fast, block-level recovery and protection against disk or pool failure — but they live at the same site and share one fire, one power outage, one ransomware strain on the LAN. The Cloud Sync / rclone copy to Frankfurt is the spatially separated distance copy: it does not replace your snapshots, it complements them as the third leg of 3-2-1. Fast everyday restores still come locally from the ZFS snapshot; reaching for Frankfurt is the disaster case, when the site itself is gone. That way each layer is responsible for exactly one job.

No storage-side versioning or Object Lock — plan retention in TrueNAS

To be honest: i3 Object Storage provides NO storage-side versioning and no Object Lock/WORM. A Cloud Sync in SYNC mode mirrors — if you delete or encrypt a file locally, that change is pushed up on the next run. Your retention and rollback point therefore lives in TrueNAS: the ZFS snapshot retention (snapshot tasks with a lifetime, e.g. hourly 24 h, daily 14 days) keeps the immutable historical states locally, and the S3 copy is the off-site leg of 3-2-1. If you want to fix the last good state off-site too, use COPY instead of SYNC or separate target buckets/folders per point in time. For confidentiality, ALWAYS encrypt client-side — Remote Encryption in the Cloud Sync Task or rclone crypt — because there is no at-rest encryption on the storage side; only transport runs over TLS. The key stays with you: no password, no restore.

Transfer modes & client-side encryption

SYNC (mirror)

The target is aligned exactly to the source and also removes deleted files remotely. Lowest storage footprint, but no protection against accidental deletion — always combine this mode with local ZFS snapshot retention.

COPY

Copies new and changed files upward but NEVER deletes in the bucket. Old states stay off-site while the bucket keeps growing. Useful when you want to work without a second retention mechanism.

Remote Encryption (GUI)

The checkbox in the Cloud Sync Task encrypts filenames and contents via rclone crypt BEFORE upload. Only ciphertext lands in the bucket. Store password and salt safely — without them the copy is worthless.

rclone crypt (CLI)

The same mechanism manually: a crypt remote layered over your S3 remote. Only unreadable ciphertext reaches storage and the key never leaves the NAS. Ideal for scriptable backups with full control over the key.

Restore without cost anxiety

Inclusive egress makes retrieval predictable

With cloud backup the untested restore is the real risk. US hyperscalers bill every retrieval as egress — so people test too rarely. Here 1 TB of egress is included per booked TB of storage. You pull a dataset back as a test (Cloud Sync PULL or rclone copy in the reverse direction), check individual files and validate your recovery path without the next invoice exploding. Extra traffic is billed transparently at +€3.99/TB — predictable, not surprising. Especially when pulling back large ZFS pools, you know in advance what the restore costs instead of finding a surprise on the monthly bill.

i3 vs. Wasabi vs. Backblaze B2 as a TrueNAS target

	Wasabi	Backblaze B2	intercolo i3
Location / data residency	EU region selectable, US corporation	EU region selectable, US corporation	Frankfurt DC, 100% DE, GDPR/DPA
Endpoint	s3.eu-central-*.wasabisys.com	s3.eu-central-*.backblazeb2.com	https://de-fra.i3storage.com (de-fra)
TrueNAS integration	S3 Compatible / rclone	B2 native or S3 / rclone	S3 Compatible Cloud Sync / rclone
Egress model	'free' up to storage limit, then throttled	1 TB free/day, then per GB	1 TB incl./TB, then +€3.99/TB
Starting storage price	List price US$/TB	List price US$/TB	€2.49/TB
Support / contact	Ticket, EN	Ticket, EN	Direct, German, DC team
Power	varies	varies	100% green power

Plan retention: snapshot retention instead of Object Lock

ZFS snapshot task

Your immutable historical states come from periodic snapshot tasks with a lifetime (e.g. hourly 24 h, daily 14 days). This history lives locally and is your actual rollback point — the S3 copy only secures the current state off-site.

Do 3-2-1 cleanly

3 copies, 2 media, 1 off-site: production pool plus local replication as the fast copies, the Frankfurt copy as the distance leg. Regularly verify with a test restore that the off-site copy is really readable and complete.

Separate buckets & keys

Split datasets or retention classes into their own buckets, each with its own API key pair (SigV4). That keeps the blast radius of a compromised key small and billing per bucket easy to trace.

Storitev migracije shranjevanja

Migriramo vaše podatke namesto vas

Naše izkušnje govorijo same zase: Uspešno smo izvedli migracije, ki so vključevale več petabajtov podatkov in več kot 500 milijonov datotek.

500M+

files migrated

Petabytes

of data migrated

since 2006

in business

Kontaktirajte nas

Pogosta vprašanja

Imate še vprašanja?

Vprašajte nas neposredno

Which provider do I pick in TrueNAS for intercolo?

Always 'S3 Compatible' — not the native Amazon S3 entry. Only that type allows the custom endpoint de-fra.i3storage.com. Enter de-fra as the region and your access/secret key pair (SigV4) as credentials. Then build a Cloud Sync Task on top of it.

Cloud Sync Task or rclone — which should I use?

The GUI Cloud Sync Task suits scheduled, monitored jobs with alerts and is the default path. rclone on the shell is the choice for scripting, edge cases and crypt chains. Both speak the same endpoint https://de-fra.i3storage.com in region de-fra — you can even mix them.

SYNC or COPY in the Cloud Sync Task?

SYNC mirrors the source and also deletes removed files remotely — lean, but with no protection against accidental deletion. COPY never deletes in the bucket and keeps old states. Since there is no storage-side versioning, you control retention via ZFS snapshot retention; SYNC plus local snapshots is the usual choice.

Is my data encrypted in object storage?

There is no at-rest encryption on the storage side; transport runs over TLS. For confidentiality, enable Remote Encryption in the Cloud Sync Task or use rclone crypt — data is then encrypted client-side BEFORE upload, the key stays with you and only ciphertext lands in the bucket.

Is there Object Lock or versioning against ransomware?

Not on the storage side — no Object Lock/WORM, no versioning. Protection comes from your local ZFS snapshot history (ideally on a separate, unmounted target) plus the spatially separated off-site copy in 3-2-1. Keep the last good state via snapshots, not via the bucket.

What does a restore from Frankfurt cost?

1 TB of egress is included per booked TB of storage, which covers regular test restores. Traffic beyond that costs a predictable +€3.99/TB. You retrieve via Cloud Sync PULL or rclone copy in the reverse direction — you know the price in advance.

Do path-style and virtual-hosted both work?

Both: path-style https://de-fra.i3storage.com/<bucket> and virtual-hosted https://<bucket>.de-fra.i3storage.com. For rclone, endpoint https://de-fra.i3storage.com with region de-fra is enough; TrueNAS picks the right addressing automatically.

Uporabljamo piškotke

Potrebni Vedno aktivno

Nastavitve

Analitika

Trženje

Potrebni