DPTCloud
Back to articles
Technology Insight

Securing Virtualized Infrastructure: Deploying Proxmox Backup Server (PBS) on Hetzner VPS for Enterprise Off-Site Redundancy

June 6, 2026

Introduction: The Imperative of Off-Site Data Protection

In the contemporary digital landscape, data resiliency is no longer a luxury—it is a critical pillar of business continuity. As enterprises increasingly migrate workloads to virtualized environments like Proxmox Virtual Environment (Proxmox VE), the architecture safeguarding these environments must evolve accordingly. Relying solely on local backups leaves an organization vulnerable to localized failures, ransomware attacks, and datacenter-wide disasters. To mitigate these catastrophic risks, adhering to the classic 3-2-1 backup strategy—3 copies of data, across 2 different media types, with 1 copy stored off-site—is paramount.

This technical guide provides a comprehensive framework for establishing a secure, efficient, and cost-effective off-site backup infrastructure. By deploying Proxmox Backup Server (PBS) on a Hetzner Cloud Virtual Private Server (VPS), enterprises can leverage the synergy of enterprise-grade deduplication and ultra-low-cost, high-performance European infrastructure. This combination ensures that your virtual machines (VMs) and containers (LXCs) are secure, cryptographically verified, and rapidly recoverable at a fraction of the cost of legacy enterprise backup solutions.

Why Proxmox Backup Server and Hetzner Cloud?

Architecting an off-site backup strategy requires balancing performance, security, and budgetary constraints. The pairing of PBS and Hetzner Cloud addresses these requirements perfectly:

  • Proxmox Backup Server (PBS): Unlike traditional backup tools that copy entire disk images repeatedly, PBS introduces advanced chunk-based deduplication. It splits data streams into small, identifiable chunks, ensuring that identical data across multiple VMs or backup cycles is stored only once. This drastically reduces storage consumption and minimizing network bandwidth saturation. Furthermore, it supports native client-side encryption and incremental-forever backups.
  • Hetzner Cloud: Renowned for its exceptional price-to-performance ratio, Hetzner offers robust infrastructure based in Germany, Finland, and the United States. Its cloud instances feature high-speed NVMe local storage or highly scalable block storage volumes, backed by redundant multi-gigabit network uplinks. This guarantees rapid data transfer during intensive backup windows and predictable monthly operational expenses.

Architectural Overview and Network Topology

Before executing command-line installations, it is vital to conceptualize the structural framework of our off-site backup pipeline. The production environment (on-premise or in an alternative cloud data center) connects securely to the remote Hetzner PBS instance over the public internet or a dedicated virtual private network (VPN).

Security Principle: Because backup repositories contain sensitive corporate data, all traffic traversing the public internet must be encrypted. PBS natively encrypts all traffic in transit using TLS, and the backup contents themselves can be client-side encrypted before leaving your production environment.

Data validation happens continuously. When Proxmox VE initiates a backup, the local system calculates hashes of data chunks, queries the remote PBS to check if those chunks already exist, and transmits only the missing elements. This process makes daily or hourly off-site synchronization completely feasible even over standard business broadband connections.

Step 1: Provisioning and Preparing the Hetzner VPS

To begin, log into the Hetzner Cloud Console and provision a new compute instance. For a production-ready PBS deployment, consider the following baseline resource configuration:

  1. Instance Type: Choose a dedicated or shared vCPU instance with at least 2 vCPUs and 4GB of RAM (e.g., the CX line or CPX line). PBS relies heavily on RAM for caching deduplication index tables.
  2. Operating System: Select Debian 12 (Bookworm), as Proxmox Backup Server is natively built on and integrated with the Debian ecosystem.
  3. Storage Allocation: Depending on your retention policy, attach a Hetzner Cloud Volume (Block Storage) to the instance. This decouples your backup storage repository from the OS root disk, allowing for seamless storage expansion in the future.

Once the instance is online, connect via SSH and perform standard system updates, followed by formatting and mounting your secondary storage volume:

apt update && apt upgrade -y
mkfs.ext4 /dev/sdb
mkdir -p /mnt/pbs-storage
mount /dev/sdb /mnt/pbs-storage
echo "/dev/sdb /mnt/pbs-storage ext4 defaults,nofail 0 2" >> /etc/fstab

Step 2: Installing Proxmox Backup Server on Debian

With the baseline operating system optimized, we must add the official Proxmox repository to pull the verified PBS binaries. Execute the following commands sequentially to import the GPG keys and configure the package manager:

# Add the Proxmox Backup Server repository key
wget https://enterprise.proxmox.com/debian/proxmox-release-bookworm.gpg -O /etc/apt/trusted.gpg.d/proxmox-release-bookworm.gpg

# Configure the non-production / community repository
echo "deb http://download.proxmox.com/debian/pbs bookworm pbs-no-subscription" > /etc/apt/sources.list.d/pbs-enterprise.list

# Update package lists and install the backup daemon
apt update
apt install proxmox-backup-server -y

During the installation phase, you will be prompted to configure mail handlers and package behaviors. Accept the defaults. Once completed, the PBS web interface will automatically initialize, listening on port 8007 via HTTPS.

Step 3: Initial Storage and User Configuration

Access the web-based administrative console by navigating to https://your-hetzner-ip:8007 in your browser. Bypass the self-signed SSL warning (we will address this later) and authenticate using your system root credentials.

Creating the Datastore

Navigate to the Datastore section in the main navigation menu and click Add Datastore. Define the configuration parameters as follows:

  • Name: offsite-backup-store
  • Backing Path: /mnt/pbs-storage (The mount point mapped to your Hetzner Block Storage Volume)
  • GC Schedule (Garbage Collection): Daily or weekly, depending on system performance windows.

Implementing the Least Privilege Principle

To avoid security exposure, never connect your production clusters using the global root administrative account. Instead, establish a dedicated API token or restricted backup user:

  1. Navigate to Access Control > User Management and create a new user named pbs-backup-worker.
  2. Under Permissions, assign this user the role of Datastore.Backup on the path /datastore/offsite-backup-store. This ensures that even if the client-side credential is compromised, malicious actors cannot delete existing backups from the repository.

Step 4: Hardening and Network Optimization

Exposing a backup target directly to the public internet presents an active attack surface. It is critical to execute defensive security measures:

1. Hetzner Cloud Firewall Configuration

Utilize the stateless firewall provided natively by Hetzner Cloud. Apply strict rules to drop all inbound traffic except for:

  • Port 22 (SSH) restricted solely to your corporate or administrator static IP address.
  • Port 8007 (PBS API/UI) restricted strictly to the public IP addresses of your source Proxmox VE production clusters.

2. Deploying Let's Encrypt Certificates

PBS features built-in ACME integration. By entering your domain and navigating to Certificates within the PBS dashboard, you can request a valid, free Let's Encrypt SSL certificate. This ensures encrypted traffic validation and removes browser security warnings altogether.

Step 5: Connecting Proxmox VE to Your Remote PBS

Now, bridge the local cluster to the remote cloud storage vault. Log into your production Proxmox VE interface and navigate to Datacenter > Storage > Add > Proxmox Backup Server.

Input the following parameters into the connection wizard:

  • ID: A recognizable local identifier, such as hetzner-offsite-pbs.
  • Server: The domain name or IP address of your Hetzner VPS.
  • User name: pbs-backup-worker@pbs.
  • Datastore: offsite-backup-store.
  • Fingerprint: Copy the exact SHA-256 fingerprint displayed on the dashboard homepage of your Proxmox Backup Server. This validates identity and prevents man-in-the-middle attacks.

Crucial Security Consideration: Check the box for Encryption. Generate or upload an encryption key and download the keyfile to a highly secure offline location. Warning: If your infrastructure suffers total destruction, you cannot restore these backups without this exact encryption key, as the cloud-hosted PBS cannot read the data payloads natively.

Step 6: Establishing Retention Policies and Verification Schedules

An uncontrolled accumulation of backup iterations will eventually saturate any storage array. To maintain equilibrium, define a strict retention policy inside your backup jobs using Grandfather-Father-Son (GFS) rotation rules:

A balanced enterprise policy often includes: keeping the last 7 daily backups, the last 4 weekly backups, and the last 12 monthly backups. Pruning schedules run automatically on the PBS node, reclaiming stale disk blocks via the Garbage Collection engine.

Additionally, configure regular Verify Jobs on the Hetzner PBS server. This process forces the server to read through data chunks periodically, validating cryptographically that no bit-rot or file corruption has occurred on the physical storage blocks over time.

Conclusion: Resiliency Achieved

By leveraging the architecture outlined in this guide, you have built an immutable, enterprise-grade off-site data bunker. Combining the advanced capabilities of Proxmox Backup Server with the highly accessible, affordable performance of Hetzner Cloud creates a fortress for your virtual infrastructure. Should local hardware fail or ransomware strikes your on-premise infrastructure, you can confidently reconstruct systems from clean, deduplicated, and securely encrypted backups resting safely in your cloud-based off-site facility.