Complete Guide to Deploying Proxmox Backup Server on Hetzner CX33 with Object Storage Integration

Instance Specifications#

The Hetzner CX33 is a highly cost-effective cloud server with the following specifications:

• vCPU: 4 cores (Intel Xeon or AMD EPYC)
• Memory: 8 GB
• Storage: 80 GB SSD
• Network: 1 Gbps bandwidth, 20 TB monthly traffic
• Price: Approximately €4.99/month

For small to medium-sized PVE environment backup requirements, the CX33’s performance is more than sufficient. PBS itself has modest compute resource requirements, primarily relying on memory for deduplication indexing. The 8GB memory can support multi-terabyte backup storage.

Creation Steps#

1. Log in to Hetzner Cloud Console
2. Select your project and click “Add Server”
3. Choose a Location (recommend selecting the same region as your PVE host to reduce latency)
4. Select Type: CX33
5. Select Image: Debian 13 (Trixie)
6. Configure SSH Key or password authentication
7. Confirm firewall rules, ensuring port 8007 is accessible
8. Create the server and record the assigned IP address

Adding Proxmox Software Repositories#

1
# Download and add Proxmox release signing key
2
sudo wget https://enterprise.proxmox.com/debian/proxmox-release-trixie.gpg \
3
  -O /etc/apt/trusted.gpg.d/proxmox-release-trixie.gpg
4

5
# Add PBS community edition repository (no subscription)
6
echo "deb http://download.proxmox.com/debian/pbs trixie pbs-no-subscription" | \
7
  sudo tee /etc/apt/sources.list.d/proxmox-backup-server.list

Installing the Package#

1
sudo apt update && sudo apt install proxmox-backup -y

During installation, the system will prompt for Postfix mail transfer agent configuration. If you haven’t configured a mail sending policy yet, it’s recommended to temporarily select “No configuration”. You can reconfigure later using dpkg-reconfigure postfix.

Accessing the Web Management Interface#

After installation completes, the PBS service will start automatically. Access it via browser:

1
https://<your-server-ip>:8007

You will encounter an SSL certificate warning on first access, as PBS uses a self-signed certificate. Add a security exception to proceed to the login page. By default, use the Linux system user root and its password to log in.

Creating an Object Storage Bucket#

1. Go to Hetzner Cloud Console
2. Navigate to Object Storage in the left menu
3. Select the Locations tab and enable your desired region (e.g., hel1, fsn1, or nbg1)
4. Click Create Bucket, enter a bucket name (e.g., proxmox-backups)
5. Record the bucket’s Endpoint URL format: https://<bucket-name>.<region>.your-objectstorage.com

Available endpoints

Generating Access Credentials#

1. On the Object Storage page, switch to the Credentials tab
2. Click S3 Credentials
3. Enter a description (e.g., PBS-Access)
4. Copy the generated Access Key and Secret Key

Credential Security

The Secret Key is only displayed once during creation. Please store it securely. If lost, you will need to generate new credentials.

Creating S3 Endpoint Configuration#

Log in to the PBS Web interface and follow these steps to configure:

1. Navigate to Configuration → S3 Endpoints
2. Click the Add button

Fill in the endpoint configuration:

3. Expand Advanced options
4. Set Provider Quirks to Skip

Provider Quirks Explanation

Hetzner Object Storage has subtle differences from AWS S3 in certain S3 API implementations. Enabling “Skip” quirks ensures PBS handles these differences correctly, preventing backup operation failures.

Creating the Datastore#

After configuring the S3 endpoint, create the actual datastore:

1. Navigate to the Datastore menu
2. Click Add Datastore
3. Fill in the configuration:

4. Click Add to complete creation

PBS maintains a local cache layer for storing deduplication indexes and recently accessed data blocks, reducing API call frequency to object storage and improving backup and restore performance.

Creating a PBS Backup User#

To follow the principle of least privilege, it’s recommended to create a dedicated user for PVE connections:

1. In PBS, navigate to Configuration → Access Control → User Management
2. Click Add
3. Fill in user information:
   • User name: dataguard
   • Realm: pbs (local authentication)
4. Set a strong password and record it

Configuring User Permissions#

1. Go to the Permissions tab
2. Click Add → User Permission
3. Configure:
   • Path: /hetzner-backup (select the created datastore)
   • User: dataguard@pbs
   • Role: DatastoreBackup

This role allows the user to create, read, and delete backups but cannot modify PBS system configuration.

Adding PBS Storage in PVE#

Log in to the PVE Web interface:

1. Navigate to Datacenter → Storage → Add → Proxmox Backup Server
2. Fill in the configuration:

3. Click Add to complete the addition

Configuring VM Backup Tasks#

1. Select the target node and go to the Backup tab
2. Click Add to create a backup task

Basic Settings:

Configuring Automatic Pruning Policy#

In the PBS Web interface, configure retention policies for the datastore:

1. Go to Datastore → hetzner-backup → Prune & GC
2. Click Add to create retention rules

Example Configuration (3-2-1 backup strategy variant):

3. Enable Prune Jobs for automatic pruning execution

This configuration ensures:

• Short-term recovery: Rollback to any day within the last 7 days
• Medium-term recovery: Access weekly snapshots from the past 4 weeks
• Long-term archiving: Retain monthly backups for 6 months for compliance or auditing

Testing the Backup Process#

1. Manually trigger a backup task in PVE
2. Observe task logs to confirm no errors
3. Verify in the PBS Web interface that backup snapshots have been created

Testing the Restore Process#

Regular restore testing is a critical component of any backup strategy:

1. In PBS, select a backup snapshot and click Restore
2. Select the target PVE node and storage
3. Execute the restore and verify the VM/CT starts normally

Monitoring and Alerting Recommendations#

• Backup Task Notifications: Configure notification email in PVE to receive backup failure alerts
• Storage Capacity Monitoring: Monitor object storage usage through Hetzner Console
• PBS Metrics: Visit the Metrics page to view key indicators such as deduplication ratio and transfer rates