How to Install Proxmox Backup Server on Debian 11

Proxmox Backup Server is an open-source backup solution that backs up virtual machines, containers, and physical hosts. It integrates with the Proxmox Virtual Environment platform to back up virtual machines and containers, supports both local and remote targets, and includes a web-based management interface for administering backups.

This article explains how to install Proxmox Backup Server on Debian 11. It covers setting the system hostname, adding the Proxmox repository, installing the package, serving the management interface through Nginx as a reverse proxy, securing it with a Let's Encrypt SSL certificate, and configuring the firewall.

Prerequisites

Before you begin, you need to:

• Have access to a fresh Debian 11 server as the root user.
• Point a subdomain such as pbs.example.com to your server's public IP address.

Set the System Hostname

Proxmox Backup Server issues its self-signed certificate against the system hostname and uses it to identify the host in the management interface. Set the hostname to your subdomain before installing the package so that the generated certificate matches the address you use to reach the server.

1. Open the hostname file in a text editor.

   CONSOLE

   Copy

   # nano /etc/hostname

   Explain Code

   Powered by Vultr AgentBeta

2. Replace the contents with your subdomain.

   INI

   Copy

   pbs.example.com

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

3. Open the hosts file.

   CONSOLE

   Copy

   # nano /etc/hosts

   Explain Code

   Powered by Vultr AgentBeta

4. Add the following line to map the subdomain to the loopback address.

   INI

   Copy

   127.0.0.1 pbs.example.com

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

5. Reboot the server to apply the new hostname.

   CONSOLE

   Copy

   # reboot

   Explain Code

   Powered by Vultr AgentBeta

6. Verify that the system hostname matches your subdomain.

   CONSOLE

   Copy

   # hostname

   Explain Code

   Powered by Vultr AgentBeta

   The output displays pbs.example.com.

7. Verify that the hostname resolves to the loopback address.

   CONSOLE

   Copy

   # ping pbs.example.com

   Explain Code

   Powered by Vultr AgentBeta

   The output displays replies from 127.0.0.1.

Install Proxmox Backup Server

Debian does not package Proxmox Backup Server, so the package comes from the Proxmox repository. The pbs-no-subscription repository provides the same packages as the enterprise repository without requiring a subscription key.

1. Download the repository signing key into the APT keyring.

   CONSOLE

   Copy

   # wget https://enterprise.proxmox.com/debian/proxmox-release-bullseye.gpg -O /etc/apt/trusted.gpg.d/proxmox-release-bullseye.gpg

   Explain Code

   Powered by Vultr AgentBeta

2. Open the APT sources file.

   CONSOLE

   Copy

   # nano /etc/apt/sources.list

   Explain Code

   Powered by Vultr AgentBeta

3. Add the Proxmox Backup Server repository.

   INI

   Copy

   deb http://download.proxmox.com/debian/pbs bullseye pbs-no-subscription

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

4. Refresh the package list.

   CONSOLE

   Copy

   # apt update

   Explain Code

   Powered by Vultr AgentBeta

5. Install the package.

   CONSOLE

   Copy

   # apt install proxmox-backup

   Explain Code

   Powered by Vultr AgentBeta

   The Postfix configuration wizard opens during installation. Select Internet with smarthost and accept the defaults for the remaining prompts.

6. Reboot the server.

   CONSOLE

   Copy

   # reboot

   Explain Code

   Powered by Vultr AgentBeta

7. Open the management interface in a web browser to verify the installation.

   https://pbs.example.com:8007

   The browser warns about an untrusted certificate because Proxmox Backup Server generates a self-signed certificate during installation. Accept the warning to reach the login page.

Serve the Management Interface Using Nginx

The management interface listens on port 8007, which some networks block. Configuring Nginx as a reverse proxy serves the interface on the standard HTTP and HTTPS ports instead.

1. Install Nginx.

   CONSOLE

   Copy

   # apt install nginx

   Explain Code

   Powered by Vultr AgentBeta

2. Create a virtual host file.

   CONSOLE

   Copy

   # nano /etc/nginx/sites-available/pbs

   Explain Code

   Powered by Vultr AgentBeta

3. Add the following configuration. Replace pbs.example.com with your subdomain.

   INI

   Copy

   server {
   
       listen 80;
       server_name pbs.example.com;
   
       proxy_redirect off;
       location / {
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "upgrade";
           proxy_pass https://localhost:8007;
           proxy_buffering off;
           client_max_body_size 0;
           proxy_connect_timeout  3600s;
           proxy_read_timeout  3600s;
           proxy_send_timeout  3600s;
           send_timeout  3600s;
       }
   
   }

   Explain Code

   Powered by Vultr AgentBeta

   Save and close the file.

   • proxy_set_header Upgrade and Connection "upgrade": Allow the WebSocket connections that the interface uses for its console and live task output.
   • client_max_body_size 0: Removes the upload size limit so that large backup operations are not truncated.
   • The timeout values: Keep long-running backup and restore tasks from being cut off by the proxy.

4. Enable the virtual host by linking it into the enabled sites directory.

   CONSOLE

   Copy

   # ln -s /etc/nginx/sites-available/pbs /etc/nginx/sites-enabled/

   Explain Code

   Powered by Vultr AgentBeta

5. Test the configuration syntax.

   CONSOLE

   Copy

   # nginx -t

   Explain Code

   Powered by Vultr AgentBeta

   The output displays syntax is ok and test is successful.

6. Reload Nginx to apply the configuration.

   CONSOLE

   Copy

   # systemctl reload nginx

   Explain Code

   Powered by Vultr AgentBeta

7. Open the interface in a web browser to verify that the proxy works.

   http://pbs.example.com

Secure the Management Interface Using an SSL Certificate

Proxmox Backup Server uses a self-signed certificate by default, so browsers warn that no trusted certificate authority issued it. Certbot replaces that certificate with a free Let's Encrypt certificate on the Nginx virtual host.

1. Install Certbot and the Nginx plugin.

   CONSOLE

   Copy

   # apt install certbot python3-certbot-nginx

   Explain Code

   Powered by Vultr AgentBeta

2. Issue and install the certificate. Replace pbs.example.com with your subdomain.

   CONSOLE

   Copy

   # certbot --nginx -d pbs.example.com

   Explain Code

   Powered by Vultr AgentBeta

   Certbot edits the virtual host to serve HTTPS and redirect HTTP traffic to it.

3. Open the interface over HTTPS to verify that the certificate is trusted.

   https://pbs.example.com

4. Verify that automatic renewal works.

   CONSOLE

   Copy

   # certbot renew --dry-run

   Explain Code

   Powered by Vultr AgentBeta

Configure the Firewall

Debian ships without an active firewall. Enabling ufw restricts inbound traffic to SSH and the web ports that the management interface now uses.

1. Install ufw.

   CONSOLE

   Copy

   # apt install ufw

   Explain Code

   Powered by Vultr AgentBeta

2. Allow SSH connections so that enabling the firewall does not end your session.

   CONSOLE

   Copy

   # ufw allow 'SSH'

   Explain Code

   Powered by Vultr AgentBeta

3. Allow HTTP and HTTPS connections.

   CONSOLE

   Copy

   # ufw allow 'Nginx Full'

   Explain Code

   Powered by Vultr AgentBeta

4. Enable the firewall.

   CONSOLE

   Copy

   # ufw enable

   Explain Code

   Powered by Vultr AgentBeta

   The command warns that it may disrupt existing SSH connections and asks for confirmation. Enter y to proceed.

5. Review the active rules.

   CONSOLE

   Copy

   # ufw status

   Explain Code

   Powered by Vultr AgentBeta

   The output displays SSH and Nginx Full with an ALLOW action.

Conclusion

You have successfully installed Proxmox Backup Server on Debian 11, served the management interface through Nginx as a reverse proxy, secured it with a Let's Encrypt SSL certificate, and restricted inbound traffic with a firewall. Add backup datastores and configure backup jobs from the management interface to start protecting your systems. For more information, visit the official Proxmox Backup Server documentation.