🧰 Overview

This guide walks through setting up a Proxmox Backup Server (PBS) VM, creating a ZFS-backed datastore, and configuring encrypted backups from your Proxmox node.

1. 🖥️ Create PBS VM in Proxmox

Resources Assigned

  • CPU: 2 vCPU
  • RAM: 4GB (minimum)
  • Disk 1: 32GB OS (can be on local-lvm)
  • Disk 2: Backup storage disk (e.g. 500GB from zfs-ssd)

Installation Steps

  1. Download the PBS ISO and upload it to your Proxmox ISO storage.
  2. Create a new VM:
    • Use the PBS ISO
    • Attach the secondary virtual disk for backups (e.g. zfs-ssd-pbs-zvol)
  3. Boot into the installer and follow the on-screen steps to install PBS on Disk 1.

2. 🧱 Create PBS Datastore

Once inside the PBS VM:

Format and Mount Backup Disk

Assuming your secondary disk is /dev/sdb:

# Inside PBS VM
lsblk        # Confirm disk name (e.g. sdb)

# Format with ext4
mkfs.ext4 /dev/sdb

# Create mount point and mount
mkdir -p /mnt/datastore
mount /dev/sdb /mnt/datastore

# Make it permanent
echo '/dev/sdb /mnt/datastore ext4 defaults 0 1' >> /etc/fstab

Create Datastore in PBS UI

  1. Open PBS Web UI: https://<pbs-ip>:8007
  2. Go to Datastore → Add Datastore
  3. Path: /mnt/datastore
  4. Name: zfs-ds01

3. 🔐 Add PBS Storage with Encryption

  • Go to Datacenter → Storage → Add
  • In the General tab:
    • Set ID (e.g., pbs-backup)
    • Enter PBS Server IP, Username (e.g., root@pam), and Password
    • Copy the Fingerprint from the PBS web UI (Dashboard → Show Fingerprint)
  • Under Encryption, select “Auto-generate a client encryption key”
    • Save the generated key in a secure external location
  • Click Add to save the storage config

The key will be stored in:

/etc/pve/priv/storage/<storage-id>.enc

⚠️ Backup this file externally. Without it, you cannot restore encrypted backups.

4. 📦 Create and Run Backup

  • Create a backup job from Datacenter → Backup → Add
  • Change Storage to pbs-backup, select which VMs to include
  • Set Mode to Snapshot, and choose a schedule
  • Either wait for the schedule to run or click Run Now to take the first backup

You should see entries like:

vm/102/2025-06-18T21:15:42Z (encrypted)

5. 💾 Restore an Encrypted Backup

  1. Select the PBS storage from the Proxmox node,
  2. Select a backup and click “Restore”
  3. Assign a new VM ID (or overwrite)
  4. PBS will automatically use the matching .enc key if available

If restoring on a different node, copy the .enc key to:

/etc/pve/priv/backup/