Proxmox Backup Server + Cloudflare R2

Published: December 23, 2025

Author: Khalil Imitik

Overview

Proxmox Backup Server is a robust backup solution for Proxmox VE that enables scheduled backups of your virtual machines and containers. It serves as a critical component of your disaster recovery strategy, ensuring you can restore your infrastructure after hardware failures, data corruption, or accidental deletion

Features

Incremental Backups with Deduplication

PBS divides each guest into small data chunks, naming each chunk using a hash of its contents. During backups, PBS compares these hashes to identify and skip duplicate data, storing only what’s new or changed.

🧹 Garbage Collection Job

Duplicates aren’t deleted instantly. PBS runs a daily garbage collection job to clean up orphaned chunks after prune jobs clean out old backups

Why this matters: Without deduplication, storage consumption grows rapidly.

For example, 10 VMs running the same OS (3.5 GB each) would require 35 GB without deduplication just for the operating system. But with deduplication feature, PBS stores the base OS once plus only the unique data per VM, saving approximately 31.5 GB. Actual savings depend on your deduplication ratio.

Client-Side Encryption

For extra security beyond TLS connection, enable encryption only when your VMs or LXC containers hold sensitive data or operate in restricted environments. Adds a bit of overhead, but that’s a fair trade for peace of mind.

Don’t Lose Your Key

Lose the key, lose your backups. There’s no “forgot password” button here.

Data Integrity Verification

Every chunk is named by its SHA256 hash, making corruption instantly detectable. You can schedule verification jobs to periodically re-check all chunks, or enable “Verify New” to validate each backup right after creation. If something’s off, PBS flags it and the next backup naturally re-uploads the chunk

Flexible Recovery Options

Restore entire VMs/containers, or skip the full restore and grab just the files you need. For VMs, use the file restore button in PVE to browse partitions Linux/Windows and download individual files

Before You Ask…!

Yeahh! A lot of questions might come to mind, is it reliable? Is it fast enough for backups and restores?

Well, this feature landed in ver. 4.0 and still maturing, but it’s been rock solid for me so far. As for speed, I ran some tests against the Cloudflare endpoint, to calculate or at least evaluate performance (details in setup)

Object Storage Providers

FYI, R2 isn’t your only option. You can still use Wasabi, Backblaze, AWS S3, all work! I chose Cloudflare R2 for the balance of performance, global edge network, and zero egress fees. Your wallet will thank you ദ്ദി(⎚_⎚)

So… let’s dive in!

Setup

We’ll cover connectivity, configs, and a few considerations along the way

Heads Up

All credentials shown (API tokens, fingerprints, etc.) are examples for demonstration purposes only, not valid

R2 Bucket

Head to your Cloudflare dashboard and navigate to Storage & Databases > R2 Object Storage > Overview. Create a new bucket for your backups.

Note

Keep everything the same, except when your servers are far from where you’re connecting from, in that case, change to a closer location for better speed and performance

Dedicated API Token

On the same R2 overview page, go to API Tokens and create a new account api token with “Admin read & write” permissions, Why? because PBS needs to list all buckets, and “Object Read & Write” with a single bucket scope won’t work, otherwise you’ll get a 400 error as status code, but still you can restrict access by allowing only your server’s IP. Save the credentials generated!

Note

Cloudflare doesn’t support bucket policies or deny rules like AWS S3 does yet. But hopefully soon.

Object Storage with Proxmox Backup Server

Now, switch to the PBS UI and link your S3 endpoint:

Config

• Endpoint: <account-id>.r2.cloudflarestorage.com without protocol
• Account ID: Found in the dashboard URL → dash.cloudflare.com/<account-id>
• Region: See Cloudflare’s available regions
• Path Style: Enabled

Bucket as Datastore

Then add a datastore and specify which bucket to use:

Config

• Name: Whatever you want (this is just for PBS reference, but we’re going to mention in the PVE config)
• Datastore Type: Select “S3 (tech preview)”
• Local Cache: Path for cached chunks, Use /var/lib/proxmox-backup/cache to avoid permission issues. Recommended: 1.5x your VM size (e.g., 75 GB disk = 50 GB system + 25 GB temp cache)
• S3 Endpoint ID: The endpoint you linked earlier
• Bucket: Auto-detected, but verify/choose if you have many
• GC/Prune Schedule: Daily works fine, just leave it as is

Understanding GC vs Prune

• Prune removes old backup snapshots based on your retention policy.
• Garbage Collection (GC) comes after and cleans up the actual orphaned chunks that are no longer referenced by any backup.

Think of prune as “marking for deletion” and GC as “taking out the trash”

Backup Schedules

Move into the prune options to define how long backups stick around. You can also manage this from PVE later

Simulation

If you’re not sure what retention rules to use, you can use PBS simulator

PBS with PVE

To link PVE with PBS, add it as storage under Datacenter > Storage

Backup User

Avoid using root, It’s preferable to create a dedicated backup user in PBS with the following permissions/roles:

• DatastorePowerUser → write new backups and manage retention (delete/prune old ones)
• DatastoreReader → view datastore contents, verifying backups
  OR
• DatastoreAdmin → grants full administrative access to all/specific datastore

Path: Configuration > Access Control > Users in PBS

Besides, you can also configure backup retention from PVE, but it’s recommended to manage it in PBS

Fingerprint

Since PBS uses a self-signed certificate by default, which isn’t trusted by any CA, PVE needs the fingerprint to trust & verify it’s connecting to the correct server. Find it in PBS under Dashboard > Show Fingerprint

If you use a trusted certificate (e.g., Let’s Encrypt), you can leave the fingerprint empty

Backup Job

Last but not least, add/adjust your backup job under Datacenter > Backup

Config

I run mine at 21:00 daily, well before GC/prune jobs kicks in at midnight. Thanks to deduplication, backups are fast, ~10 minutes or less in my case

Important

Do not back up the PBS VM to itself, otherwise this creates a loop and causes headaches. With object storage or NFS, your data’s already offsite (But just exclude it)

Backup Speed

Now that everything’s set up, let’s see how fast it actually runs. Here’s a quick benchmark against Cloudflare

Download

curl -o /dev/null https://speed.cloudflare.com/__down?bytes=100000000

Output

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100 95.3M    0 95.3M    0     0  79.5M      0 --:--:--  0:00:01 --:--:-- 79.6M

Upload

dd if=/dev/zero bs=1M count=100 2>&1 | curl -X POST -T - https://speed.cloudflare.com/__up -o /dev/null

Output

  % Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
100  100M    0     0    0  100M      0  59.9M --:--:--  0:00:01 --:--:-- 59.9M

For my case

• Download: ~80 MB/s (640 Mbps)
• Upload: ~60 MB/s (480 Mbps)

Pretty solid. At these speeds, a 50 GB backup takes just a few minutes. And that’s only the first run, after that, PBS only pushes new chunks

And that’s it!

Attribution required • Non-commercial • No derivatives