How to Add a Hosted Proxmox Backup Server to Proxmox VE

This guide walks through connecting a Proxmox VE node or cluster to a hosted Proxmox Backup Server (PBS) datastore at OneColo, running a first backup, and turning on client-side encryption. It applies to both Pay As You Grow and reserved instances; the only difference is where the connection details come from.

What you need

Your OneColo control panel lists everything Proxmox VE asks for under the service's details:

• Server — the PBS hostname (port 8007 is the default).
• Datastore — the datastore name assigned to you.
• Namespace (optional) — only if you asked for one; otherwise leave it blank.
• Username — an API token in the form user@pbs!tokenname.
• Password — the token secret.
• Fingerprint — the SHA-256 fingerprint of the server's TLS certificate.

Nothing needs to be opened on your firewall. Proxmox VE connects outbound to TCP 8007 over TLS, which works from behind NAT.

Step 1 — Add the storage

1. In the Proxmox VE web interface, open Datacenter → Storage and click Add → Proxmox Backup Server.
2. ID: a short name for this storage, for example onecolo-pbs. It appears in backup jobs and restore dialogs.
3. Server, Username, Password, Datastore: paste the values from the control panel exactly. Tokens are case-sensitive.
4. Namespace: fill in only if you were given one.
5. Fingerprint: paste the fingerprint. This pins the server certificate so Proxmox VE will refuse to talk to an impostor.
6. Nodes: leave at "All" for a cluster unless you want only certain nodes to back up.
7. Click Add. The storage should show as Active in the tree within a few seconds.

Step 2 — Turn on client-side encryption (recommended)

Encryption happens on your Proxmox node before any data leaves your network, and you hold the key. To enable it, select the new storage under Datacenter → Storage, click Edit, open the Encryption tab, and choose Auto-generate a client encryption key. Then:

• Download the key file and store it somewhere that is not on the cluster you are backing up.
• Print the paper key (Proxmox offers a QR code and text version) and keep it with your disaster-recovery documents.

Without the key, neither you nor OneColo can read the backups. Deduplication still works with encryption enabled because chunks are hashed before they are encrypted.

Step 3 — Run a first backup

Pick any small VM or container, open its Backup tab, click Backup now, choose the new storage and Snapshot mode, and start it. The task log will show chunks being uploaded; the first run sends everything, and every run after that is incremental. When it finishes, the snapshot appears under the storage's Backups view with its size, and after our verification job runs you will see a green verified state on it.

Then create a scheduled job under Datacenter → Backup → Add: choose the storage, a schedule, the guests to include, and your retention (keep-last, keep-daily, keep-weekly, keep-monthly). Proxmox prunes old snapshots after each run according to those values.

Troubleshooting

• "fingerprint does not match" — the fingerprint was mistyped or copied with a trailing space. Re-paste it from the control panel.
• "permission denied" or 401 — check the username is the full token form user@pbs!tokenname and the password is the token secret, not an account password.
• Connection timed out — something on your side is blocking outbound TCP 8007. Test with nc -zv <server> 8007 from the node.
• TLS or certificate errors right after setup — make sure the node's clock is correct; enable chrony or systemd-timesyncd.
• Backups are slow the first time — expected. The initial run uploads every chunk; subsequent runs only send what changed.

What next

If you run more than one cluster or manage backups for clients, ask us to create namespaces so each stays separate with its own retention. If you already run a PBS on site and want a second, offsite copy, set up a sync job instead of backing up twice. And for a broader look at strategy, read The Best Ways to Back Up Proxmox VE.