Proxmox Backup Server on Proxmox VE: Setup and Offsite Copy

Running Proxmox Backup Server on Proxmox VE is one of the most searched setups in the Proxmox community, because it gives you deduplicated, incremental VM backups without buying another server. It works, but where you put it decides whether your backups survive a real failure. This guide shows the three ways to do it, how to configure each one, and the mistake that turns a backup server into a single point of failure.

The problem: backups that live on the machine they protect

Proxmox Backup Server (PBS) is free, fast and integrates natively with Proxmox VE. The temptation is to install it on the same host that runs your virtual machines. If that host loses its disks, its RAID controller or its operating system, you lose the VMs and their backups at the same time. The consequence is a full rebuild from nothing, which for most small companies means days of downtime and permanently lost data.

The solution is not to avoid PBS on Proxmox VE, but to use it correctly: as a local, fast first copy, always paired with a second copy somewhere else.

Three ways to run Proxmox Backup Server on Proxmox VE

The official documentation also describes the recommended production layout: PBS on separate hardware. If you only have one Proxmox VE server today, any of the options above is acceptable only if you add an offsite copy, covered later in this guide.

Option 1: Proxmox Backup Server as a VM on Proxmox VE

1. Download the Proxmox Backup Server ISO from the Proxmox website and upload it to a Proxmox VE storage (local → ISO Images).
2. Create a VM with 2 to 4 vCPUs, at least 4 GB of RAM (more for large datastores), a small system disk (32 GB) and a separate disk for the datastore.
3. Prefer a dedicated physical disk for the datastore and pass it through to the VM, so backups are not stored on the same disks as the VMs they protect:

# On the Proxmox VE host: find the disk by its stable ID
ls -l /dev/disk/by-id/ | grep -v part

# Attach it to VM 200 as a second SCSI disk
qm set 200 -scsi1 /dev/disk/by-id/ata-WDC_WD40EFRX-XXXXXXXX

4. Install PBS from the ISO, then open https://PBS-IP:8007 and log in as root@pam.
5. Exclude the PBS VM itself from your Proxmox VE backup jobs. Backing up the backup server into itself only wastes space.

Option 2: install Proxmox Backup Server directly on the Proxmox VE host

Both products are based on Debian and can share the same system. Add the Proxmox Backup Server repository that matches your Debian release (bookworm for Proxmox VE 8, trixie for Proxmox VE 9). On Proxmox VE 9, with the deb822 format, create /etc/apt/sources.list.d/pbs.sources:

Types: deb
URIs: http://download.proxmox.com/debian/pbs
Suites: trixie
Components: pbs-no-subscription
Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg

Then install the package:

apt update
apt install proxmox-backup-server

The web interface runs on port 8007 of the same host, separate from the Proxmox VE interface on port 8006. Use a dedicated disk or ZFS dataset for the datastore, never the root filesystem.

Create the datastore

A datastore is the directory where PBS keeps deduplicated chunks. Create it on the dedicated disk, from the web interface (Administration → Storage / Disks) or from the shell:

# Example with a disk already formatted and mounted at /mnt/datastore/store1
proxmox-backup-manager datastore create store1 /mnt/datastore/store1

Then create a dedicated user for Proxmox VE, instead of using root:

proxmox-backup-manager user create pve-backup@pbs --password 'use-a-long-random-password'
proxmox-backup-manager acl update /datastore/store1 DatastoreBackup --auth-id pve-backup@pbs

The DatastoreBackup role can create backups and restore its own backups, but cannot delete existing snapshots. That limits the damage if the Proxmox VE host is compromised.

Connect Proxmox Backup Server to Proxmox VE

Proxmox VE verifies the PBS certificate by its fingerprint. Read it on the PBS side:

proxmox-backup-manager cert info | grep Fingerprint

In Proxmox VE, open Datacenter → Storage → Add → Proxmox Backup Server and fill in the server address, datastore, user and fingerprint. The equivalent command is:

pvesm add pbs pbs-local --server 192.168.10.20 --datastore store1 \
  --username pve-backup@pbs --password 'the-password-you-set' \
  --fingerprint 'AA:BB:CC:...'

Clear the shell history afterwards, or use the web interface, so the password does not stay in ~/.bash_history.

Enable client-side encryption in the storage settings if the datastore will ever be synced to a location you do not fully control. Store the encryption key outside the cluster: without it, encrypted backups cannot be restored.

Schedule backups, pruning, garbage collection and verification

• Backup job in Proxmox VE (Datacenter → Backup): select the VMs and containers, target pbs-local, mode snapshot, schedule outside peak hours.
• Prune job in PBS: for example keep-daily 7, keep-weekly 4, keep-monthly 6.
• Garbage collection: frees the chunks no longer referenced after pruning. Schedule it daily or weekly.
• Verify job: re-reads chunks and checks their checksums, so silent disk corruption is detected before you need a restore.

The Proxmox VE backup guide explains backup modes and retention in more detail.

The step most setups skip: the offsite copy

With PBS on Proxmox VE, the offsite copy is not optional. PBS can pull a datastore from another PBS with a remote and a sync job, transferring only new chunks. A second PBS in another building, a rented server or a provider that offers PBS-compatible storage keeps your backups available if the main host is lost. Since Proxmox Backup Server 4, datastores can also use S3-compatible object storage (still marked as a technology preview at release), which is another way to keep a copy away from the host.

Follow the 3-2-1-1-0 rule and read how to back up Proxmox virtual machines to the cloud for the offsite options.

Test a restore before you need it

Restore one VM to a new VM ID every month, boot it with the network disconnected and check the application. Also practice a file-level restore from the PBS interface. If the Proxmox VE host is the one that fails, you need to know how to reinstall it, add the PBS storage again and restore: the Proxmox disaster recovery guide covers that sequence.

Summary

1. PBS on Proxmox VE works as a VM, as a package on the host or, with care, in a container.
2. Always use a dedicated disk for the datastore and a dedicated user with limited permissions.
3. Schedule prune, garbage collection and verify jobs.
4. Add an offsite copy: without it, the backup dies with the host.

Backnix is being designed to provide offsite protection for Proxmox VE and Proxmox Backup Server datastores. See the Proxmox backup page for the current status and the storage plans.

References

• Proxmox Backup Server documentation: Installation
• Proxmox Backup Server documentation: Backup Storage
• Proxmox VE documentation: Storage

Topics: DatastoreOffsite backupProxmox Backup ServerProxmox VE