One PBS, many clients: the MSP playbook

How namespaces isolate clients

A PBS datastore can be divided into namespaces — nested, folder-like scopes that each hold their own backup groups, with permissions applied per namespace. One datastore becomes:

datastore/
  acme-corp/        ← client A's guests
  blue-clinic/      ← client B's guests
  cargo-logistics/  ← client C's guests

Each client's PVE cluster backs up into its own namespace and can neither see nor touch the others. Deduplication still works across the whole datastore underneath — twenty clients' near-identical Debian VMs share chunks — so the isolation costs you nothing in storage. This wants the PBS WebUI, which is why the MSP pattern lives on Dedicated Instances, not Dynamic.

Tokens: one per client, none shared

Create an API token per client and grant it DatastoreBackup on that client's namespace path only. The properties that matter:

• A compromised client site can write garbage into its own namespace — and nothing else. Client A's ransomware incident is not client B's problem, and it can't delete even its own history.
• Offboarding is revoking one token and (eventually) pruning one namespace.
• Your admin credential — the one that can prune and manage — never touches client infrastructure. Same permission model as the immutability guide, multiplied by clients.

Per-client retention, one console

Prune jobs apply per namespace, so each client's contract maps to its own keep-* policy — the dentist keeps 7 years of monthlies, the e-commerce shop keeps 30 days of nightlies, both on one server. Verification jobs cover the whole datastore, and the task log gives you one place to answer "did every client back up last night?" For designing the policies themselves, see retention schedules.

Sizing and tiers

Estimate per-client stored size the way you would for one shop — source size, change rate, retention, then dedup/compression typically shrinking it well below source — and sum. Cross-client dedup gives you headroom the per-client math doesn't show.

• Starting out (a few clients): 10–25TB Dedicated Instance at $6.95/TB — $69.50–$173.75/month.
• Established book (10–30 clients): 50–75TB at $5.95/TB — $297.50–$446.25/month, with 8 vCPU and 16–24GB RAM behind it.
• Big book or compliance isolation: the 100TB bare-metal server at $4.95/TB — physically yours, no other tenants, and we build custom beyond that.

The business side

• The margin math is simple: you buy TB wholesale at $4.95–$6.95 and sell managed backup — a service with your monitoring, your drills, your reporting on top — at service prices. Storage is the cheapest ingredient in what you're actually selling.
• Transfer doesn't eat the margin: inbound is unmetered, outbound is included up to the tier, and your first month is fully unmetered for seeding client datasets.
• Restore drills become a deliverable. A quarterly test restore per client, with the recovery time in their report, is the easiest retention tool in managed services.
• You keep the relationship. Clients see your service; the PBS is infrastructure. We run the racks, the ZFS, and the NVMe metadata layer underneath — and you reach the engineers directly when you need us.