diff --git a/index.md b/index.md
index 3e2fa9414c5fdd0771d83e777df43547a2aa77ed..0064eb00fc7c268c36ac3d48dca0268ee28d08b5 100644
--- a/index.md
+++ b/index.md
@@ -14,7 +14,7 @@ Data Management Services is a portfolio of services allowing to facilitate the w
---
- **S3** is a general service suitable for most of the usecases (archives, backups, special applications...). It also allows to share your data with other users or publicly via link.
+ **S3** is a general service suitable for most of the usecases (archives, backups, special applications...). It also allows to share your data with other users or publicly via link. It can be connected from all over the world ;-).
[:octicons-arrow-right-24: Overview of S3 Service](./object-storage/s3-service.md)<br/>
[:octicons-arrow-right-24: Favourite S3 Clients](./object-storage/s3-clients.md)<br/>
@@ -27,9 +27,11 @@ Data Management Services is a portfolio of services allowing to facilitate the w
---
- Do you need common **Object Storage Services**?
+ **RBD** is Rados Block Device service. **RBD** is Rados Block Device service. The prerequisite for this service is a Linux machine with a public IPv4 address.
+
+ [:octicons-arrow-right-24: Overview of RBD Service](./object-storage/rbd-service.md)<br/>
+ [:octicons-arrow-right-24: Setup of RBD Service](./object-storage/rbd-setup.md)<br/>
- [:octicons-arrow-right-24: RBD Service](https://du.cesnet.cz/en/navody/sluzby/start)
<!---
[:octicons-arrow-right-24: Account properties and lifecycle](/account/properties)
--->
diff --git a/mkdocs.yml b/mkdocs.yml
index a57003676e8fe99c74fed089bb54b4c00286f4ea..bf7a5c59b0ebb3cf196fed23a128409cd6df2a00 100755
--- a/mkdocs.yml
+++ b/mkdocs.yml
@@ -8,5 +8,6 @@ nav:
- Advanced S3 features: object-storage/s3-features.md
- Veeam backup over S3: object-storage/veeam-backup.md
- RBD Service:
- - RBD Sevice: object-storage.md
+ - RBD Overview: object-storage/rbd-service.md
+ - RBD Setup: object-storage/rbd-setup.md
- FAQ: faq.md
diff --git a/object-storage/rbd-service-screenshots/central_backup.png b/object-storage/rbd-service-screenshots/central_backup.png
new file mode 100644
index 0000000000000000000000000000000000000000..ae0e6b21094e2013aec4e899433b54efb0c5019a
Binary files /dev/null and b/object-storage/rbd-service-screenshots/central_backup.png differ
diff --git a/object-storage/rbd-service-screenshots/shared_distribution.png b/object-storage/rbd-service-screenshots/shared_distribution.png
new file mode 100644
index 0000000000000000000000000000000000000000..b239a54a9a67d888640a25482347ed039011e8fc
Binary files /dev/null and b/object-storage/rbd-service-screenshots/shared_distribution.png differ
diff --git a/object-storage/rbd-service.md b/object-storage/rbd-service.md
index aaab98309911156b9d6895c98f4d3c13eaf7ab12..191f9f9c80078e08192cb6f5247a9997de448c79 100644
--- a/object-storage/rbd-service.md
+++ b/object-storage/rbd-service.md
@@ -3,8 +3,51 @@ languages:
- en
- cs
---
+# RBD Service
-# Object Storage
+The Rados Block Device **RBD** is a block device that you can connect into your infrastructure. The connection must be done using a **Linux machine** (RBD connection to Windows is not yet implemented in reliable manner). Subsequently, you can re-export the connected block device anywhere within your systems (samba remount to your network). RBD is particularly suitable for use in centralized backup systems. RBD is a very specialized service that requires the user to have extensive experience in managing Linux devices. The service is intended for larger volumes of data - hundreds of TB. The block device can also be encrypted on your side (client side) using LUKS. Client-side encryption also means that the transmission of data over the network is encrypted, and in case of eavesdropping during transmission, the data cannot be decrypted. Access to the service is controlled by virtual organizations and coresponding groups.
-Detail documentation for Object Storage services could be found at [du.cesnet.cz](https://du.cesnet.cz/en/navody/object_storage/start)
+!!! warning
+ RBD connection is only possible from dedicated IPv4 addresses that are enabled on the firewall in our Data Centers. An RBD image can only be subsequently mounted on **ONE** machine, it is not possible for each of your users to mount the same RBD on their workstation - having said that the RBD is not used as clustered file system. Usage of clustered file systems over RBD must first be consulted with Data Care support.
+???+ note "How to get RBD service?"
+ To connect to RBD service you have to contact support at:
+ `support@cesnet.cz`
+
+----
+## RBD elementary use cases
+In the following section you can find the description of elementary use cases related to RBD service.
+
+### Large dataset backups requiring local filesystem
+If you have a centralized backup system (script suite, bacula, BackupPC…) requiring local file system, then we recommend you to use [RBD service](rbd-setup.md), see the figure below. The RBD image can be connected directly to the machine where the central backup system is running, as a block device. RBD can then be equipped with snapshots, see service description, as protection against unwanted overwriting or ransomware attacks.
+
+{ style="display: block; margin: 0 auto" }
+
+### Centralized shared storage for internal redistribution
+If you need to store live data and need to provide the storage for individual user, then you can use [RBD](rbd-setup.md) service which you can connect to you infrastructure using a Linux machine. You can create a file system on the connected block device, or equip it with encryption, and then re-export them inside your infrastructure using, for example, samba, NFS, ftp, ssh, etc. (also in the form of containers ensuring the distribution of protocols to your internal network). Client-side encryption also means that the data transmission over the network is encrypted and the data cannot be decrypted once the transmission is sent. The advantage is that you can create groups and manage rights according to your preferences, or use your local database of users and groups. The RBD block device can also be equipped with snapshots at the RBD level, so if data is accidentally deleted, it is possible to return to a snapshot from the previous day, for example.
+
+{ style="display: block; margin: 0 auto" }
+
+## RBD Data Reliability (Data Redundancy) - replicated vs erasure coding
+In the section below are described additional aproaches for data redundancy applied to the object storage pool. RBD service can be equipped with **replicated** or **erasure code (EC)** redundancy or with **synchronous/asynchronous geographical repliacation**.
+
+### Replicated
+Your data is stored in three copies in the data center. In case one copy is corrupted, the original data is still readable in an undamaged form, and the damaged data is restored in the background. Using a service with the replicated flag also allows for faster reads, as it is possible to read from all replicas at the same time. Using a service with the replicated flag reduces write speed because the write operation waits for write confirmation from all three replicas.
+
+???+ note "Suitable for?"
+ Suitable for smaller volumes of live data with a preference for reading speed (not very suitable for large data volumes).
+
+### Erasure Coding (EC)
+Erasure coding (EC) is a data protection method. It is similar to the dynamic RAID known from disk arrays. Erasure coding (EC) is a method where data is divided into individual fragments, which are then stored with some redundancy across the data storage. Therefore, if some disks (or the entire storage server) fail, the data is still accessible and will be restored in the background. So it is not possible for your data to be on one disk that gets damaged and you lose your data.
+
+???+ note "Suitable for?"
+ Suitable, for example, for storing large data volumes.
+
+### RBD snapshots
+Snapshots can be used at the RBD (replicated/erasure coding) level. Snapshots are controlled from the client side. [RBD snapshotting](rbd-setup.md) is one of the replacement options for the `tape_tape` policy - snapshots mirrored to another geographic location, see below.
+
+### Synchronous geographical replication
+Synchronous geographical replication protects against data center failure. Synchronous geographical replication degrades write speed because the system waits for a successful write confirmation at both geographic locations. If you feel that you need this service, please contact us.
+
+### Asynchronous geographical replication
+Asynchronous geographical replication partially protects against data center failure (certain data may be lost between individual asynchronous synchronizations due to time lag). However, with an asynchronous geographical replication, in case of data corruption (ransomware), you can disrupt the replication and safe your data. If you feel that you need this service, please contact us.
diff --git a/object-storage/s3-features.md b/object-storage/s3-features.md
index 00eff68f5c661cce285e2b57b7372226e2bcbc32..db8cb869dbe8f3d4a4e8e60ba3c1c114f9d4c511 100644
--- a/object-storage/s3-features.md
+++ b/object-storage/s3-features.md
@@ -416,3 +416,4 @@ And check the object versions.
}
## Setup bucket policies for sharing (AWS-CLI S3 plugin)
+Coming soon...
diff --git a/object-storage/s3-service.md b/object-storage/s3-service.md
index 7febb53fb5c3b62154adb5a1e6dc0aae889eaf0d..d2849ce26443677afc06e39634dcf1d3c085c94f 100644
--- a/object-storage/s3-service.md
+++ b/object-storage/s3-service.md
@@ -10,8 +10,8 @@ S3 service is a general service suited for most of the use cases. S3 service can
Access to the service is controlled by virtual organizations and coresponding groups. S3 is suitable for sharing data between individual users and groups that may have members from different institutions. Tools for managing groups and users are provided by the e-infrastructure. Users with access to S3 can be people, as well as "service accounts", for example for backup machines (a number of modern backup tools support natively S3 connection). Data is organized into buckets in S3. It is usually appropriate to link individual buckets to the logical structure of your data workflow, for example different stages of data processing. Data can be stored in the service in an open form or in case of sensitive data it is possible to use encrypted buckets on the client side. Where even the storage manager does not have access to the data. Client-side encryption also means that the transmission of data over the network is encrypted, and in case of eavesdropping during transmission, the data cannot be decrypted.
???+ note "How to get S3 service?"
- To connect to S3 service you have to contact Data Storage support at:
- `du-support@cesnet.cz`
+ To connect to S3 service you have to contact support at:
+ `support@cesnet.cz`
----
## S3 Elementary use cases
@@ -32,8 +32,17 @@ You have large data and you operate an application in e-infrastructure that issu
{ style="display: block; margin: 0 auto" }
+### Personal space for your data
+This case is similar to the VO storage service. This is a personal space in the S3 service just for your data, which does not allow sharing with a specific user. [Public reading](s3-features.md) can be set for buckets, or [presign URL requests](s3-features.md) can be used.
+
+### Dedicated S3 endpoint for special applications
+This is a special service for selected customers/users. This dedicated S3 endpoint can be used for critical systems as protection against DDoS attacks. The endpoint would be hidden for other users, only insiders would know about it.
+
+### Any other application
+**If you need a combination of the services listed above, or if you have an idea about some other application of object storage services, do not hesitate to contact us.**
+
## S3 Data Reliability (Data Redundancy) - replicated vs erasure coding
-In the section below are described two aproaches for data redundancy applied to the object storage pool. S3 service can be equipped with **replicated** or **erasure code (EC)** redundancy.
+In the section below are described additional aproaches for data redundancy applied to the object storage pool. S3 service can be equipped with **replicated** or **erasure code (EC)** redundancy.
### Replicated
Your data is stored in three copies in the data center. In case one copy is corrupted, the original data is still readable in an undamaged form, and the damaged data is restored in the background. Using a service with the replicated flag also allows for faster reads, as it is possible to read from all replicas at the same time. Using a service with the replicated flag reduces write speed because the write operation waits for write confirmation from all three replicas.
@@ -46,6 +55,3 @@ Erasure coding (EC) is a data protection method. It is similar to the dynamic RA
???+ note "Suitable for?"
Suitable, for example, for storing large data volumes.
-
-
-
diff --git a/object-storage/veeam-backup.md b/object-storage/veeam-backup.md
new file mode 100644
index 0000000000000000000000000000000000000000..57d4b8e206b8c9d3197267aa60050df43ba3049c
--- /dev/null
+++ b/object-storage/veeam-backup.md
@@ -0,0 +1,12 @@
+---
+languages:
+ - en
+ - cs
+---
+
+# Veeam backup suite
+
+!!! warning
+ This guide is under construction.
+
+