Proxmox Backup Server: Installation and Initial Setup

Proxmox Backup Server (PBS) is a specialized solution for backing up VMs and LXC containers. PBS supports incremental backups, block-level deduplication, and end-to-end encryption. It can be installed as a standalone server or on the same machine as Proxmox VE.

PBS Architecture

Datastore — backup storage, created on a disk/ZFS pool
Chunk Store — storage for deduplicated blocks
Namespaces — logical grouping of backups by project/team
Remote — synchronization between multiple PBS instances

Installing PBS

# Download the Proxmox Backup Server ISO from proxmox.com
# Install it the same way as Proxmox VE (separate ISO)

# After installation, add the no-subscription repository
echo "deb http://download.proxmox.com/debian/pbs trixie pbs-no-subscription"   > /etc/apt/sources.list.d/pbs-no-subscription.list

apt update && apt dist-upgrade -y

The PBS web interface is available at: https://PBS-IP:8007

Creating a Datastore

# Via CLI
proxmox-backup-manager datastore create backup-store /mnt/backup   --comment "Main backup storage"

# Verify
proxmox-backup-manager datastore list

# Storage statistics
proxmox-backup-manager datastore show backup-store

Adding PBS to Proxmox VE

# On the Proxmox VE host
# Datacenter → Storage → Add → Proxmox Backup Server
pvesm add pbs my-pbs   --server 192.168.1.200   --datastore backup-store   --username backup@pbs   --password PBSPassword   --fingerprint AA:BB:CC:...  # Get this from PBS → Dashboard → Fingerprint

Creating a Backup User

# On the PBS server
proxmox-backup-manager user create backup@pbs --password BackupPass123

# Assign permissions on the datastore
proxmox-backup-manager acl update /datastore/backup-store   --auth-id backup@pbs   --role DatastoreBackup

PBS roles: Use the DatastoreBackup role (write only) for the account used by Proxmox VE. Restoring requires the DatastoreReader role.

Encrypting Backups

# Create an encryption key
proxmox-backup-client key create /root/backup.key

# Or via the web interface:
# Storage → my-pbs → Edit → Encryption Key

CRITICAL: Store the encryption key (/root/backup.key) in a secure location SEPARATE from PBS. Without the key, restoring encrypted backups is impossible.

Monitoring PBS

# Task status
proxmox-backup-manager task list --limit 20

# Deduplication statistics
proxmox-backup-manager datastore show backup-store

# Integrity check
proxmox-backup-manager garbage-collect backup-store

PBS-to-Proxmox VE connection errors

Three errors that most commonly show up when first connecting PBS as storage.

TASK ERROR: connection error: error trying to connect: tcp connect error: Connection refused
TASK ERROR: authentication failed: fingerprint mismatch
TASK ERROR: backup write data failed: no space left on device

Connection refused: PBS is unreachable on port 8007 — check that the proxmox-backup-proxy service is running on PBS and that the port is not blocked by a firewall between the hosts.
fingerprint mismatch: the PBS certificate changed (server reinstall, certificate renewal), but the Proxmox VE storage settings still hold the old fingerprint. Update it under Datacenter → Storage → my-pbs → Edit, taking the current value from PBS → Dashboard.
no space left on device: the PBS datastore is full and garbage collection has not run in a while, or is disabled. Run proxmox-backup-manager garbage-collect backup-store and check the GC schedule.

When PBS is not the right fit

PBS covers most VM backup needs, but it is not universal.

A single server with no way to keep backups on separate hardware: PBS on the same machine as Proxmox VE protects against logical errors and data corruption, but not against the disk or the server itself failing entirely.
A very small setup with one or two VMs and infrequent changes — plain vzdump into a local directory with file rotation may be enough; standing up a separate service is not always justified.
Backing up files outside Proxmox (workstations, plain Linux servers not under the hypervisor) — PBS is built for VMs and LXC containers; for arbitrary files, use dedicated tools (restic, borg).

Verifying the setup result

Before relying on PBS in production, confirm that the connection and the first backup actually work.

# Check that the storage is active on the Proxmox VE side
pvesm status

# Check the backup account's login directly
proxmox-backup-client login --repository backup@pbs@192.168.1.200:backup-store

# Run a test backup of one VM and check the task
vzdump 100 --storage my-pbs --mode snapshot
pvesh get /nodes/pve/tasks --typefilter vzdump --limit 1

If the test backup finishes with an OK status and shows up in the datastore's snapshot list, the setup is correct. Setting up a schedule for regular jobs is covered in backup schedule in Proxmox VE and PBS.

Frequently asked questions

What happens if the PBS backup encryption key is lost?

If the encryption key is lost, recovering encrypted data from the backup becomes impossible — neither the PBS administrator nor Proxmox support can decrypt the chunks without that key. That's why the key is kept separately from the backup server itself, for example in a password manager or on physical media, rather than only locally next to the datastore.

Does PBS have to run on a server separate from Proxmox VE?

No, PBS can be installed on the very same machine as Proxmox VE, but that setup only protects against logical errors and data corruption, not against the server or disk itself failing entirely. For real protection against a hardware failure, the backup datastore needs to live on separate physical hardware or in another location.

Can a VM be restored from a PBS backup onto a different cluster node than the one it originally ran on?

Yes, a PBS backup isn't tied to its source node — restoring works on any Proxmox VE cluster node connected to the same PBS storage, and it's enough to pick the right snapshot and the target node in the restore interface. That's convenient when shifting load around or replacing hardware without rebuilding a VM from scratch.

Does garbage collection on the datastore need to run manually, or does it happen on its own?

Garbage collection does not run automatically without a schedule — it needs to be triggered regularly, either by hand or through a scheduled job, otherwise the datastore gradually fills up with unused data chunks and free space runs out faster than the size of the current backups would suggest.