Projects · Guides

Install Proxmox Backup Server for the lab

Done: PBS has a dedicated datastore, Proxmox VE can see it as a storage id, and a scratch guest has been restored and booted.

Requirements

Proxmox Backup Server is the lab’s off-guest backup target. Proxmox VE snapshots guests into it. The PBS host is not a general app server. Its UI stays on the lab LAN. A guest you cannot restore is a guest you do not have.

Change the example names. Do not use them as live names. This page does not print the live datastore, the disk path, or addresses.

Write the numbers down. “Keep everything” lasts until the disk fills and prune becomes an emergency.

Procedure

1. Name the host and the disks

The installer wipes the OS disk you select. Name the disks before you boot it.

1. Write down the hostname pbs.example.lab. Put it in lab DNS, forward and reverse, when the host exists.
2. On the hardware, name two disks and keep them apart: the OS disk, and the datastore disk. The datastore disk stays out of the installer target.
3. If you can see the disks from another OS before you boot the ISO, list them:

   # lsblk
   # expect: one disk sized for the OS; one larger disk for the datastore
   

4. If the datastore disk still has snapshots, you will reattach it in step 3. You will not initialize it.

2. Install from the ISO

The ISO is the path the project publishes. It installs Debian, the PBS stack, and the UI on port 8007.

1. Download the installer ISO from https://www.proxmox.com/downloads.
2. Write it to a USB flash drive. Substitute the real device. A wrong of= wipes that disk.

   # lsblk
   # dd bs=1M conv=fdatasync if=./proxmox-backup-server_*.iso of=/dev/XYZ
   

3. Boot the server from that USB. You may need to pick the USB in firmware boot order.
4. At the GRUB menu, choose Install Proxmox Backup Server (Graphical). Answer the installer like this:

   Install Proxmox Backup Server (Graphical)
   EULA: I agree
   Target hard disk: the OS disk, not the datastore disk
   Country / timezone / keyboard: your lab
   Root password: set it; store it in the vault, not here
   Email: a mailbox you read
   Hostname: pbs.example.lab
   Network: lab LAN, as your lab uses
   

5. Wait for the copy to finish. Remove the installer medium. Reboot. The UI listens on HTTPS port 8007.
6. Log in as root on the console or over SSH. Check the name and the clock:

   # hostname
   pbs.example.lab
   
   # timedatectl
   # expect: NTP synchronized: yes
   

7. If apt later returns 401 on the enterprise repo, disable that repo and use the no-subscription repo. That is a packaging detail. It is not a reason to skip backups.

3. Create the datastore, then the storage id

PVE can only snapshot into a datastore it can see. Create the datastore on the dedicated disk, then add the storage id.

The PBS console picture is missing. Do not invent one. The web UI on port 8007 can do this work. This page does not have that picture, so the steps below are CLI.

1. On PBS as root, list disks. Substitute the real datastore disk name from this list. Do not copy sdX.

   # proxmox-backup-manager disk list
   # expect: OS disk in use; datastore disk unused
   #         (or already holding a datastore you will reattach)
   

2. If the datastore disk is blank, initialize it and create the filesystem plus datastore:

   # proxmox-backup-manager disk initialize sdX
   # proxmox-backup-manager disk fs create lab-primary --disk sdX --filesystem ext4 --add-datastore true
   

   If the disk still has snapshots, skip initialize. Reattach the existing filesystem. Do not format it.

3. Confirm the datastore:

   # proxmox-backup-manager datastore list
   # expect:
   # ┌─────────────┬────────────────────────────┐
   # │ name        │ path                       │
   # ╞═════════════╪════════════════════════════╡
   # │ lab-primary │ /mnt/datastore/lab-primary │
   # └─────────────┴────────────────────────────┘
   

4. Create a backup user. New users have no rights until you set an ACL. Type the password at the prompt. Store it in the vault, not here.

   # proxmox-backup-manager user create backup@pbs
   # proxmox-backup-manager user update backup@pbs --password
   # expect: a password prompt
   
   # proxmox-backup-manager acl update /datastore/lab-primary DatastoreBackup --auth-id backup@pbs
   # proxmox-backup-manager acl list
   # expect: backup@pbs on /datastore/lab-primary with DatastoreBackup
   

5. Read the TLS fingerprint:

   # proxmox-backup-manager cert info | grep Fingerprint
   # expect: Fingerprint (sha256): AA:BB:...
   

6. On a PVE node, add the storage. --password with no value prompts. Paste the fingerprint from PBS. Put the password in the vault, not here.

   # pvesm add pbs pbs-lab \
       --server pbs.example.lab \
       --datastore lab-primary \
       --username backup@pbs \
       --fingerprint <fingerprint-from-pbs> \
       --content backup \
       --password
   # expect: a password prompt, then no error
   

7. Confirm PVE can see it:

   # pvesm status --storage pbs-lab
   # expect: pbs-lab, type pbs, active
   

8. A second backup path can exist. It is not the primary until you have restored from it on purpose. Do not move the only jobs onto a path you have not restored.

4. Schedule snapshots on Proxmox VE

Jobs live on Proxmox VE. A cron on the PBS host is not a guest backup.

1. Open the Proxmox VE UI. Go to Datacenter → Backup → Add.
2. Fill the form:

   Storage: pbs-lab
   Schedule: 02:00 daily
   Selection: all guests
   Mode: snapshot
   Compression: zstd
   Notes: lab-daily
   

3. Set prune with keep-last, keep-daily, and keep-weekly. Write the numbers down.
4. Add a tighter job for the identity and vault guests (directory, vault, git, broker) with a longer monthly keep. A new install gets a new job id. A leftover UUID is not sacred.
5. Confirm the job exists. Do not start a live backup against production guests from this page.

   # pvesh get /cluster/backup
   # expect: a job whose storage is pbs-lab
   

5. Prove restore on a scratch guest

A scheduled job that says OK is a job that ran. It is not a guest you can boot. Restore a disposable guest once, and boot it.

1. Pick unused VMIDs. 9001 is the scratch source. 9002 is the restore target. Never identity or vault.
2. On the PVE node that holds 9001, snapshot it into PBS:

   # vzdump 9001 --storage pbs-lab --mode snapshot --compress zstd
   # expect: TASK OK
   

3. Find the snapshot id:

   # pvesm list pbs-lab | grep 9001
   # expect: a backup volume for VMID 9001
   

4. Restore to a new VMID, then start it:

   # qmrestore pbs-lab:backup/vm/9001/<snapshot> 9002
   # qm start 9002
   

5. Open the 9002 console. Read the hostname. It is the scratch guest.
6. Remove the scratch guest:

   # qm stop 9002 && qm destroy 9002
   # expect: 9002 gone; live identity and vault VMIDs untouched
   

Alternative: install on Debian

The ISO is the path above. Packages on an existing Debian host are a different path. Do not mix them in the same install.

1. On a Debian host that is not the hypervisor, add the Proxmox PBS repo the project documents, then install:

   # apt update
   # apt install proxmox-backup-server
   

2. If apt returns 401 on the enterprise repo, disable it and use pbs-no-subscription.
3. Continue from step 3. Installing PBS on the hypervisor itself is not this guide.

Verification

# proxmox-backup-manager datastore list
# expect: lab-primary with a path on the dedicated disk, not the OS disk

# pvesm status
# expect: pbs-lab, type pbs, active

# On the scratch restore: hostname from inside 9002 matches the scratch guest.
# Live identity and vault VMIDs were not the restore target.

Done when the scratch guest boots from the backup, and the live identity guests were not the ones you restored over.

Datastore config is /etc/proxmox-backup/datastore.cfg. Task logs are under /var/log/proxmox-backup/. If a datastore create fails, start there.

Next

Keep identity and vault on the daily job. Snapshot the vault guest before a Vaultwarden version jump. Do not point the only daily job at a secondary store you have not restored from.

Lab only · PBS · Voice: OWNER-VOICE.md · GUIDE-DESIGN-LAW recut 2026-10-04 · figure: shot missing on purpose (datastore not opened)