How to Set Up Proxmox Backup Server for Off-Site Backups

Proxmox Backup Server is built for incremental, deduplicated backups of Proxmox VE virtual machines and containers. It can encrypt backup data on the client, verify stored chunks, apply retention policies and restore a complete guest or individual files. Those features solve a lot of operational work, but only after the storage is placed somewhere that can survive the incident you are planning for.

This guide uses Proxmox Backup Server 4 on Debian 13. The interface and exact package versions will change over time, so keep the current Proxmox documentation beside the guide when deploying production infrastructure.

Start with the Backup Architecture

A straightforward design has three distinct parts:

1. Proxmox VE: the source cluster running production VMs and containers.
2. Proxmox Backup Server: a separate host with its own credentials and datastore.
3. Another recovery copy: a second PBS, removable media or another protected target for the most important workloads.

Keep the PBS administration account separate from Proxmox VE. Give the hypervisor a token that can write backups to one datastore, not unrestricted root access to the backup server. If production credentials are stolen, the attacker should not automatically gain the power to erase every recovery point.

Network placement matters too. Permit TCP 8007 only from trusted administration and Proxmox VE addresses, or carry management traffic over a private network or VPN. Do not publish the PBS login page to the whole internet simply because it is convenient.

Size Proxmox Backup Server for the Repository

Proxmox lists 2 CPU cores, 2 GB RAM and more than 8 GB disk as evaluation minimums. Its production guidance starts at 4 CPU cores and 4 GiB RAM, then adds roughly 1 GiB RAM per TiB of storage. Fast random I/O is important because deduplication works with many chunks and metadata operations.

HDD-backed repositories benefit from fast metadata storage. HYEHOST Storage VPS uses HDD data capacity with an SSD boot disk on RAIDZ2-backed storage with NVMe cache; it can suit smaller remote repositories where capacity matters more than maximum ingest speed. For large backup windows, many simultaneous jobs or strict isolation, use a dedicated server or colocated storage system.

Install Proxmox Backup Server 4 on Debian 13

The official ISO is the simplest bare-metal route. On a clean Debian 13 system, Proxmox also supports installing the server from its package repository. First configure either the subscription-backed enterprise repository or the no-subscription repository described in the official repository guide. Then install the minimal server package:

apt update
apt full-upgrade -y
apt install proxmox-backup-server

Confirm the hostname resolves to the server address before continuing. After installation, open:

https://pbs.example.net:8007

Sign in as root@pam, install pending updates and configure notifications. Use the enterprise repository for production where additional package validation and support are required. The no-subscription repository is intended for testing and non-production use.

Mount Storage and Create the Datastore

Attach and mount the intended data volume before creating the datastore. Use a stable mount path such as /mnt/pbs-data, verify it survives a reboot and confirm that PBS is not about to write into the small operating-system filesystem.

findmnt /mnt/pbs-data
df -h /mnt/pbs-data
proxmox-backup-manager datastore create offsite /mnt/pbs-data

The same datastore can be created in the web interface under Datastore > Add Datastore. Give it a clear name such as offsite, set a garbage-collection schedule and add a comment describing the source cluster and recovery owner.

Do not copy a datastore with ordinary file-sync tools while it is active. Use PBS sync jobs when moving backup groups between Proxmox Backup Server instances; they understand the datastore format and transfer only missing chunks.

Create a Restricted Backup Identity

Create a dedicated user such as pve-backup@pbs, then create an API token for the Proxmox VE cluster. Store the token secret immediately because the interface will not display it again.

Grant the token DatastoreBackup on /datastore/offsite. This permits the source to create backups without handing it broad administrative control. Keep pruning and datastore administration on PBS so a compromised hypervisor cannot quietly shorten retention.

• Use one token per cluster or trust boundary.
• Do not reuse the root password in Proxmox VE.
• Restrict firewall access to known source addresses.
• Enable two-factor authentication for interactive administrators.
• Send job failures and datastore warnings to a monitored address.

Connect Proxmox VE to PBS

In Proxmox VE, open Datacenter > Storage > Add > Proxmox Backup Server. Enter the PBS address, datastore name, token identity, token secret and TLS certificate fingerprint. Add an optional client-side encryption key when the recovery process includes secure off-site key storage.

Store the encryption key and recovery material somewhere outside both systems. Client-side encryption is valuable only if the key survives the failure. Losing it turns healthy-looking encrypted backups into data that nobody can restore.

Create a backup job under Datacenter > Backup. Start with one low-risk VM, run a manual backup and inspect the task log on both sides before scheduling the rest of the estate.

Set Retention, Garbage Collection and Verification

Retention should match recovery needs, not an arbitrary number of snapshots. A sensible small-environment policy might retain the last 24 hourly backups, 7 daily backups, 4 weekly backups and 6 monthly backups. Adjust those values for data change rate, repository size and business requirements.

Pruning removes snapshots from the retention set. Garbage collection later reclaims unreferenced chunks. They are separate operations, so schedule both. Verification reads and checks stored backup data; run it regularly, stagger it away from the busiest ingest window and investigate failures immediately.

Run a Restore Test Before Calling It a Backup

The first restore should happen while nothing is on fire. Pick a small VM and restore it with a new VM ID onto an isolated network. Confirm that it boots, files open, services start and the application data is from the expected point in time.

1. Choose a backup snapshot in Proxmox VE.
2. Select Restore and use a temporary VM ID.
3. Disconnect or isolate its network before first boot.
4. Boot the guest and verify application-level data.
5. Record the time taken and any manual steps.
6. Remove the test guest after documenting the result.

Repeat the exercise on a schedule. A successful nightly job proves data was accepted; a successful restore proves the team can recover it.

Common Proxmox Backup Server Mistakes

• Running PBS on the production hypervisor: one host failure can remove compute and recovery access together.
• Giving Proxmox VE root credentials: use a restricted API token on one datastore.
• Keeping encryption keys only on the cluster: retain an offline recovery copy.
• Pruning without garbage collection: snapshots disappear but space is not reclaimed as expected.
• Never testing restores: green backup jobs do not prove application recovery.
• Ignoring transfer time: the first full backup and disaster restore must fit the available network window.

Proxmox Backup Server FAQ

Can Proxmox Backup Server run on a VPS?

Yes, especially for labs, smaller clusters and an additional off-site copy. Production suitability depends on storage performance, repository size, isolation and recovery targets. Larger estates generally benefit from dedicated hardware.

Which port does Proxmox Backup Server use?

The web interface and API use HTTPS on TCP port 8007. Restrict it to trusted management and backup sources instead of exposing it broadly.

Are PBS backups incremental or full?

PBS sends incremental data and stores deduplicated chunks, while each snapshot behaves as a complete recovery point. This reduces repeat transfer and storage without creating a fragile traditional incremental chain.

Does PBS replace every other backup?

No. It is an excellent Proxmox-aware layer, but important data still needs another copy and a tested path for recovering credentials and encryption keys.

Build for the Restore, Not the Dashboard

A good PBS deployment is deliberately boring: a separate location, narrow credentials, predictable schedules, monitored capacity and a restore procedure the team has already used. Begin with one VM, verify every stage and expand only after the recovery path works.

For a small remote repository, compare HYEHOST Storage VPS capacity plans. For larger backup windows or stronger isolation, review dedicated servers, colocation and private networking options.

Official Resources

• Proxmox Backup Server installation
• PBS system requirements
• Datastores, pruning and garbage collection
• Proxmox VE integration
• HYEHOST Storage VPS