Proxmox Backup Server is an open-source backup solution that backs up virtual machines, containers, and physical hosts. It integrates with the Proxmox Virtual Environment platform to back up virtual machines and containers, supports both local and remote targets, and includes a web-based management interface for administering backups.

This article explains how to install Proxmox Backup Server on Debian 11. It covers setting the system hostname, adding the Proxmox repository, installing the package, serving the management interface through Nginx as a reverse proxy, securing it with a Let's Encrypt SSL certificate, and configuring the firewall.

Prerequisites

Before you begin, you need to:

• Have access to a fresh Debian 11 server as the root user.
• Point a subdomain such as pbs.example.com to your server's public IP address.

Set the System Hostname

Proxmox Backup Server issues its self-signed certificate against the system hostname and uses it to identify the host in the management interface. Set the hostname to your subdomain before installing the package so that the generated certificate matches the address you use to reach the server.

1. Open the hostname file in a text editor.

   console Copy

   # nano /etc/hostname
   

   Explain Code

2. Replace the contents with your subdomain.

   ini Copy

   pbs.example.com
   

   Explain Code

   Save and close the file.

3. Open the hosts file.

   console Copy

   # nano /etc/hosts
   

   Explain Code

4. Add the following line to map the subdomain to the loopback address.

   ini Copy

   127.0.0.1 pbs.example.com
   

   Explain Code

   Save and close the file.

5. Reboot the server to apply the new hostname.

   console Copy

   # reboot
   

   Explain Code

6. Verify that the system hostname matches your subdomain.

   console Copy

   # hostname
   

   Explain Code

   The output displays pbs.example.com.

7. Verify that the hostname resolves to the loopback address.

   console Copy

   # ping pbs.example.com
   

   Explain Code

   The output displays replies from 127.0.0.1.

Install Proxmox Backup Server

Debian does not package Proxmox Backup Server, so the package comes from the Proxmox repository. The pbs-no-subscription repository provides the same packages as the enterprise repository without requiring a subscription key.

1. Download the repository signing key into the APT keyring.

   console Copy

   # wget https://enterprise.proxmox.com/debian/proxmox-release-bullseye.gpg -O /etc/apt/trusted.gpg.d/proxmox-release-bullseye.gpg
   

   Explain Code

2. Open the APT sources file.

   console Copy

   # nano /etc/apt/sources.list
   

   Explain Code

3. Add the Proxmox Backup Server repository.

   ini Copy

   deb http://download.proxmox.com/debian/pbs bullseye pbs-no-subscription
   

   Explain Code

   Save and close the file.

4. Refresh the package list.

   console Copy

   # apt update
   

   Explain Code

5. Install the package.

   console Copy

   # apt install proxmox-backup
   

   Explain Code

   The Postfix configuration wizard opens during installation. Select Internet with smarthost and accept the defaults for the remaining prompts.

6. Reboot the server.

   console Copy

   # reboot
   

   Explain Code

7. Open the management interface in a web browser to verify the installation.

   https://pbs.example.com:8007

   The browser warns about an untrusted certificate because Proxmox Backup Server generates a self-signed certificate during installation. Accept the warning to reach the login page.

Serve the Management Interface Using Nginx

The management interface listens on port 8007, which some networks block. Configuring Nginx as a reverse proxy serves the interface on the standard HTTP and HTTPS ports instead.

1. Install Nginx.

   console Copy

   # apt install nginx
   

   Explain Code

2. Create a virtual host file.

   console Copy

   # nano /etc/nginx/sites-available/pbs
   

   Explain Code

3. Add the following configuration. Replace pbs.example.com with your subdomain.

   ini Copy

   server {
   
       listen 80;
       server_name pbs.example.com;
   
       proxy_redirect off;
       location / {
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "upgrade";
           proxy_pass https://localhost:8007;
           proxy_buffering off;
           client_max_body_size 0;
           proxy_connect_timeout  3600s;
           proxy_read_timeout  3600s;
           proxy_send_timeout  3600s;
           send_timeout  3600s;
       }
   
   }
   

   Explain Code

   Save and close the file.

   • proxy_set_header Upgrade and Connection "upgrade": Allow the WebSocket connections that the interface uses for its console and live task output.
   • client_max_body_size 0: Removes the upload size limit so that large backup operations are not truncated.
   • The timeout values: Keep long-running backup and restore tasks from being cut off by the proxy.

4. Enable the virtual host by linking it into the enabled sites directory.

   console Copy

   # ln -s /etc/nginx/sites-available/pbs /etc/nginx/sites-enabled/
   

   Explain Code

5. Test the configuration syntax.

   console Copy

   # nginx -t
   

   Explain Code

   The output displays syntax is ok and test is successful.

6. Reload Nginx to apply the configuration.

   console Copy

   # systemctl reload nginx
   

   Explain Code

7. Open the interface in a web browser to verify that the proxy works.

   http://pbs.example.com

Secure the Management Interface Using an SSL Certificate

Proxmox Backup Server uses a self-signed certificate by default, so browsers warn that no trusted certificate authority issued it. Certbot replaces that certificate with a free Let's Encrypt certificate on the Nginx virtual host.

1. Install Certbot and the Nginx plugin.

   console Copy

   # apt install certbot python3-certbot-nginx
   

   Explain Code

2. Issue and install the certificate. Replace pbs.example.com with your subdomain.

   console Copy

   # certbot --nginx -d pbs.example.com
   

   Explain Code

   Certbot edits the virtual host to serve HTTPS and redirect HTTP traffic to it.

3. Open the interface over HTTPS to verify that the certificate is trusted.

   https://pbs.example.com

4. Verify that automatic renewal works.

   console Copy

   # certbot renew --dry-run
   

   Explain Code

Configure the Firewall

Debian ships without an active firewall. Enabling ufw restricts inbound traffic to SSH and the web ports that the management interface now uses.

1. Install ufw.

   console Copy

   # apt install ufw
   

   Explain Code

2. Allow SSH connections so that enabling the firewall does not end your session.

   console Copy

   # ufw allow 'SSH'
   

   Explain Code

3. Allow HTTP and HTTPS connections.

   console Copy

   # ufw allow 'Nginx Full'
   

   Explain Code

4. Enable the firewall.

   console Copy

   # ufw enable
   

   Explain Code

   The command warns that it may disrupt existing SSH connections and asks for confirmation. Enter y to proceed.

5. Review the active rules.

   console Copy

   # ufw status
   

   Explain Code

   The output displays SSH and Nginx Full with an ALLOW action.

Conclusion

You have successfully installed Proxmox Backup Server on Debian 11, served the management interface through Nginx as a reverse proxy, secured it with a Let's Encrypt SSL certificate, and restricted inbound traffic with a firewall. Add backup datastores and configure backup jobs from the management interface to start protecting your systems. For more information, visit the official Proxmox Backup Server documentation.