Replication and Sync

Overview

Replication mirrors snapshots from one datastore to another over an encrypted channel. Ironcore Backup Solution (IBS) supports both push (Primary site initiates) and pull (Backup site initiates) topologies, with bandwidth throttling, schedule control, and end-to-end integrity verification. This page covers configuring sync jobs, choosing the right topology, and validating the result. The standard configuration mirrors weekly full backups from the Primary DC to the Backup site for long-term archival.

Prerequisites

Administrator role on the Polystack platform
At least two datastores — one at the Primary DC site, one at the Backup site
Network connectivity between sites on TCP/8007 (TLS 1.3)
Identical encryption keys configured on both sites if push-time encryption is enabled

Topology

Direction	Use When
Push	Primary site initiates. Best when the Backup site sits behind a firewall and the Primary has outbound access.
Pull	Backup site initiates. Best when the Primary site cannot reach the Backup site, or for security separation.

Register the Remote Site

Before creating a sync job, register the remote endpoint as a Remote.

Deployment Console
CLI

Open Remotes

Navigate to Backup Solution > Replication > Remotes.

Add a new remote

Click Add Remote. Enter:

Name: backup-site
Host: ibs.backup.<your-domain>
Port: 8007
Auth-ID: sync@polystack!replication
Fingerprint: TLS certificate fingerprint from the remote

Test connectivity

Click Test. The Dashboard probes the remote and reports reachability.

Save

Click Save.

The remote is listed under Replication and is selectable in sync jobs.

ironcore-backup remote create \
  --name backup-site \
  --host ibs.backup.<your-domain> \
  --port 8007 \
  --auth-id "sync@polystack!replication" \
  --fingerprint "AB:CD:EF:..."

Verify connectivity

ironcore-backup remote test backup-site

Always verify the remote’s TLS fingerprint out-of-band. A man-in-the-middle attack would otherwise be undetectable. The fingerprint is shown on the remote’s web interface under Certificates.

Create a Push Sync Job (Primary → Backup Site)

This is the recommended configuration for weekly archival replication.

Deployment Console
CLI

Open Sync Jobs

Navigate to Backup Solution > Replication > Sync Jobs.

Click Create Sync Job

Click Create Sync Job.

Set source and target

Set:

Name: primary-to-backup-archival
Source datastore: ibs-primary
Remote: backup-site
Remote datastore: ibs-archival
Direction: Push

Filter snapshots

Set Include filter to keep-weekly=* so only weekly snapshots replicate, not daily incrementals.

Set schedule

Set the schedule to Sun 04:30 — runs after the weekly full backup at 03:00 and after the daily prune at 05:00.

Set bandwidth and encryption

Configure:

Bandwidth limit: based on your inter-site link capacity
Encrypt in transit: enabled (default)
Encrypt snapshots on the fly: enabled — encrypts at push time using the project key

Save

Click Save.

The sync job appears in the list with the next scheduled run time.

Create a push sync job

ironcore-backup sync create \
  --name primary-to-backup-archival \
  --source ibs-primary \
  --remote backup-site \
  --remote-repository ibs-archival \
  --direction push \
  --schedule "Sun 04:30" \
  --include "keep-weekly=*" \
  --bwlimit 100 \
  --encrypt

Create a Pull Sync Job (Backup Site → Primary)

A pull sync runs on the Backup site, fetching snapshots from the Primary. Used when the Backup site cannot accept inbound connections from the Primary, or for security separation.

Create a pull sync job

ironcore-backup sync create \
  --name backup-pulls-from-primary \
  --source ibs-archival \
  --remote primary-site \
  --remote-repository ibs-primary \
  --direction pull \
  --schedule "Sun 04:30" \
  --include "keep-weekly=*" \
  --bwlimit 100

A pull sync requires the remote registration on the Backup site, with the Primary site as the remote.

Encryption in Transit

Layer	Mechanism	Notes
Transport	TLS 1.3	Mandatory between sites
Chunk	Already encrypted on the client side (AES-256-GCM)	No additional encryption needed
Sync-time chunk encryption	Optional opt-in	Encrypts unencrypted source chunks before push

If the source datastore holds unencrypted snapshots (legacy or unencrypted-by-policy workloads), enable Encrypt on push so the destination receives encrypted chunks. The destination must hold the matching decryption key for any restore from the Backup site.

Bandwidth Management

Sync jobs typically run during off-hours, but inter-site link capacity may be shared with production traffic. Use bandwidth limits to coexist.

Setting	Effect
`--bwlimit 100`	Cap at 100 MiB/s
`--bwlimit 0`	Unlimited (default)
Schedule with `JobIO` weight	Lower-priority IO scheduling on the source datastore

Filter Expressions

Filter	Matches
`keep-weekly=*`	Any snapshot retained by a `keep-weekly` window
`keep-monthly=*`	Any snapshot retained by a `keep-monthly` window
`backup-id:vm/12345`	A specific source group
`namespace:production`	An entire namespace
Combined	Filters are OR-combined: any match passes

Integrity Verification

After every sync, the destination runs a SHA-256 verification on the newly received chunks. The result is recorded in the destination snapshot’s verification report. If a chunk fails verification, IBS automatically retries up to 3 times before marking the sync as failed and emitting a notification.

Replication Monitoring

Metric	Where
Sync task progress	Tasks panel — live progress and bytes transferred
Last sync result per source	Datastore detail panel — Last sync column
Verification status per replica	Snapshot detail — Verification tab
Inter-site bandwidth	Datastore statistics — Replication bandwidth chart

Recover From a Failed Sync

Sync failed mid-transfer

Failed syncs do not leave the destination in an inconsistent state — chunks are committed only after the full manifest is signed. Re-run the sync; only chunks that did not complete are retransmitted.

ironcore-backup sync run --name primary-to-backup-archival

Destination drifted from source

Compare datastores with ironcore-backup sync diff. The diff lists snapshots present on only one side. Re-run the sync to align.

ironcore-backup sync diff \
  --source ibs-primary \
  --remote backup-site \
  --remote-repository ibs-archival

TLS fingerprint mismatch after certificate renewal

The remote’s TLS certificate was renewed. Update the registered fingerprint after verifying the new certificate out-of-band.

ironcore-backup remote update \
  --name backup-site \
  --fingerprint "<new-fingerprint>"

Disaster Recovery Workflow

When the Primary site is unavailable and you need to restore from the Backup site:

Designate the Backup site as the new restore source

Operators connect their backup CLI or Dashboard to the Backup site directly.

Restore the workload

Use the standard restore procedures from the Backup site datastore. Choose the most recent weekly archival snapshot.

Reverse the sync

After the Primary site is recovered, configure a temporary reverse sync to re-seed the Primary datastore with any snapshots created in the meantime.

Restore normal direction

Once the Primary is fully re-seeded, restore the original sync direction.

Next Steps

Verification and Validation

Schedule SHA-256 verification on both sites

Tape and Object Storage

Layer on long-term tape archival from the Backup site

Security and Encryption

Key handling for snapshots that replicate between sites

Infrastructure Sizing

Capacity planning across both Primary and Backup sites

Core Services

Other Services

Overview

Topology

Register the Remote Site

Open Remotes

Add a new remote

Test connectivity

Save

Create a Push Sync Job (Primary → Backup Site)

Open Sync Jobs

Click Create Sync Job

Set source and target

Filter snapshots

Set schedule

Set bandwidth and encryption

Save

Create a Pull Sync Job (Backup Site → Primary)

Encryption in Transit

Bandwidth Management

Filter Expressions

Integrity Verification

Replication Monitoring

Recover From a Failed Sync

Disaster Recovery Workflow

Designate the Backup site as the new restore source

Restore the workload

Reverse the sync

Restore normal direction

Next Steps

Verification and Validation

Tape and Object Storage

Security and Encryption

Infrastructure Sizing

​Overview

​Topology

​Register the Remote Site

Open Remotes

Add a new remote

Test connectivity

Save

​Create a Push Sync Job (Primary → Backup Site)

Open Sync Jobs

Click Create Sync Job

Set source and target

Filter snapshots

Set schedule

Set bandwidth and encryption

Save

​Create a Pull Sync Job (Backup Site → Primary)

​Encryption in Transit

​Bandwidth Management

​Filter Expressions

​Integrity Verification

​Replication Monitoring

​Recover From a Failed Sync

​Disaster Recovery Workflow

Designate the Backup site as the new restore source

Restore the workload

Reverse the sync

Restore normal direction

​Next Steps

Verification and Validation

Tape and Object Storage

Security and Encryption

Infrastructure Sizing

Overview

Topology

Register the Remote Site

Create a Push Sync Job (Primary → Backup Site)

Create a Pull Sync Job (Backup Site → Primary)

Encryption in Transit

Bandwidth Management

Filter Expressions

Integrity Verification

Replication Monitoring

Recover From a Failed Sync

Disaster Recovery Workflow

Next Steps