IMMUTABLE DEDUP BACKUP VAULT EgressZero Editorial · 2026-11-12

Restic & Borg Append-Only Backup Vault: EgressZero Glacier & Archive Penalty Audit

Hyperscaler cold tiers (AWS Glacier, GCP Archive) advertise sub-cent storage rates, then hit backup teams with 90–180 day early-deletion penalties, per-1,000 chunk retrieval surcharges, and $90–$120/TB egress fees during disaster recovery drills. On EgressZero, we model an append-only `rest-server` or `borg serve --append-only` vault on InterServer $6/TB slices with $0 restore tax.

EgressZero FinOps Note: Deduplicating backup engines rewrite packfiles constantly—making 180-day archive retention rules financially toxic.

EGRESSZERO SIZING VERDICT
Running a 10 TB deduplicated Restic repository with monthly restore verification averages $842/mo on cold cloud tiers versus $60.00/mo on InterServer 10 TB ZFS slices in our EgressZero model ($9,384/yr saved).

EgressZero Append-Only Restic REST Server Systemd Hardening Unit

# /etc/systemd/system/restic-vault.service
[Service]
User=resticvault
ExecStart=/usr/local/bin/rest-server \
  --path /mnt/zfs-pool/restic-repos \
  --append-only \
  --private-repos \
  --tls --tls-cert /etc/ssl/vault/fullchain.pem --tls-key /etc/ssl/vault/privkey.pem \
  --listen :8443
Restart=always
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/mnt/zfs-pool/restic-repos

EgressZero Production Cutover Checklist for RESTIC

Enforce `--append-only` on the receiving vault daemon so a compromised production root SSH key cannot issue `restic forget --prune` to wipe snapshots.
Schedule `restic check --read-data-subset=10%` weekly—at $0/GB egress, continuous cryptographic verification incurs zero cloud charges.
Store repository encryption passphrases inside an offline password vault isolated from production cluster secrets.

Provision on InterServer via EgressZero ↗ Compare Vultr Option via EgressZero ↗

EgressZero chart (restic-borg-offsite-backup): 1 TB to 50 TB/mo outbound bandwidth cost slope comparing AWS S3, Vercel, and fixed-pipe servers — Fig 1 (EgressZero): Metered AWS S3 ($87/TB) and Vercel ($150/TB) invoices scale linearly while fixed-pipe NVMe/ZFS servers stay flat.

EgressZero diagram (restic-borg-offsite-backup): zero-downtime S3 repatriation pipeline using staged rclone sync and 60s DNS TTL cutover to MinIO — Fig 2 (EgressZero): Background rclone sync plus a 60-second DNS endpoint flip migrates S3 buckets to MinIO without dual-billing spikes.

EgressZero architecture (restic-borg-offsite-backup): NGINX 4 MB byte-range NVMe slice caching shielding bulk ZFS and RAID media arrays — Fig 3 (EgressZero): NGINX 4 MB slice caching absorbs 94%+ of HTTP 206 byte-range pulls on NVMe before touching bulk ZFS spindles.

EgressZero topology (restic-borg-offsite-backup): continuous PostgreSQL WAL and Restic backup replication onto $6/TB Price-Lock ZFS with $0 restore fees — Fig 4 (EgressZero): Encrypted pgBackRest and Restic streams onto $6/TB ZFS slices enable weekly full-restore DR drills with $0 egress fees.

EgressZero Scale-by-Scale TCO Ledger (restic-borg-offsite-backup)

Dataset & Monthly Egress Tier	Metered Cloud Bill	Matched Fixed-Pipe Host	12-Month Net Retained
2 TB Dedup Repo + Quarterly Full DR Drill	$226 / mo avg	$12.00 / mo (InterServer 2TB)	$2,568 / yr
10 TB Multi-Cluster Repo + Monthly Restore Test	$842 / mo avg	$60.00 / mo (InterServer 10TB)	$9,384 / yr
20 TB Fleet Backup + 10 TB Recovery Bandwidth	$1,685 / mo avg	$99.00 / mo (Dedicated 20TB)	$19,032 / yr

Modeled by EgressZero Editorial using published 2026-11-12 vendor rate schedules; live promotional rates remain subject to change.

INTERACTIVE FINOPS ESCAPE LEDGER (PURE DOM)

EgressZero Monthly Outbound TB Egress Bleed & Storage TCO Calculator

1. Metered Cloud Incumbent

2. Active Stored Dataset 10 TB

3. Monthly Outbound Egress 5 TB / mo

4. Target Self-Hosted Stack

METERED CLOUD BILL

$821.08/mo

Egress tax = 73% ($597.80/mo)

MATCHED FIXED-PIPE SERVER

$60/mo

InterServer 10TB ZFS Storage Array (Price-Lock)

MONTHLY NET RETAINED

$761.08/mo

Cuts monthly spend by 93%

12-MONTH RETAINED CAPITAL

$9,132.96/yr

12-month retained engineering budget

Metered Cloud Spend$821.08/mo

Capacity-Matched Fixed Pipe$60/mo

Continuous pgBackRest / WAL-G & ZFS send/receive with free full-restore disaster recovery drills.

Deploy #1 EgressZero Escape Architecture ↗

#1 EGRESSZERO OPTIMAL MATCH $60/mo · Save $9,132.96/yr

InterServer 10TB ZFS Storage Array (Price-Lock)

Lowest fixed per-TB storage floor ($6/TB slices up to 20TB+ dedicated) with lifetime Price-Lock renewal protection.

Inspect InterServer Specs via EgressZero ↗

CAPACITY-MATCHED OPTION #2 $119/mo · Save $8,424.96/yr

UltaHost Bare-Metal Unmetered Media Origin (8TB–20TB)

True unmetered outbound transfer in Singapore, Tokyo, Frankfurt & US — built for high-egress Video Origin & S3 edge pulls.

Inspect UltaHost Specs via EgressZero ↗

CAPACITY-MATCHED OPTION #3 $214/mo · Save $7,284.96/yr

Vultr S3 Object + Compute Pool (SG/TYO/Global)

Global bandwidth pooling across 32 edge regions (Singapore & Tokyo included) with $0.01/GB overage (89% below AWS S3).

Inspect Vultr Specs via EgressZero ↗

EgressZero Repatriation Thresholds for restic-borg-offsite-backup

Choose Hyperscaler S3 / Managed CDN (EgressZero Rule) If:

You write WORM legal compliance tarballs once a year, never run deduplication compaction, and never download test restores.

Choose Unmetered / Fixed-Pipe VPS (EgressZero Rule) If:

You run nightly Restic, Borg, or Kopia deduplication with `forget --prune` and automate weekly cryptographic DR restore verification.

EgressZero Engineering FAQ: restic-borg-offsite-backup

Why do EgressZero equations penalize AWS Glacier when paired with Restic or Borg?

During `prune`, Restic repacks partially unreferenced 8 MB–16 MB packfiles and deletes older objects. On 90-to-180-day archive storage classes, deleting a 21-day packfile triggers pro-rated early deletion charges plus Class A API retrieval fees.

How does EgressZero recommend reclaiming disk space safely on an `--append-only` vault?

Execute scheduled maintenance pruning locally via an isolated admin account directly on the backup host console only after automated health checks confirm production clusters are intact.