Remote backup server

[bbuster]

I have 2 proxmox backup servers.
One is located in the same rack as my proxmox cluster, one is located at a different location.

The proxmox backup server that is located at my office has 4tb of backups already.
I installed a new remote backup server today and created a pull job. Connection seems to work but it doesn't download data.

The log shows:

2025-11-13T18:13:59+01:00: Starting datastore sync job 'pm-backup:development:development::s-xxxxxxxx-xxx’
2025-11-13T18:13:59+01:00: sync datastore 'development' from 'pm-backup/development'
2025-11-13T18:13:59+01:00: ----
2025-11-13T18:13:59+01:00: Syncing datastore 'development', root namespace into datastore 'development', root namespace
2025-11-13T18:13:59+01:00: found 0 groups to sync (out of 0 total)
2025-11-13T18:13:59+01:00: Finished syncing root namespace, current progress: 0 groups, 0 snapshots
2025-11-13T18:13:59+01:00: Summary: sync job found no new data to pull
2025-11-13T18:13:59+01:00: sync job 'pm-backup:development:development::s-xxxxxxxx-xxx’' end
2025-11-13T18:13:59+01:00: queued notification (id=xxxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxx)
2025-11-13T18:13:59+01:00: TASK OK

It finds the datastore but it doesn't seem to find the backups that are already in there. What am i doing wrong?

 

[Johannes S]

How did you configure the permissions?

 

[bbuster]

I gave permissions on role DatastoreBackup for that user

 

[Johannes S]

I gave permissions on role DatastoreBackup for that user

This is needed to do backups from your ProxmoxVE server to the PBS. For reading from the datastore it's not needed:

Datastore.Read
Datastore.Read allows a user to read arbitrary backup contents, independent of the backup group owner.

Datastore.Verify
Allows verifying the backup snapshots in a datastore.

Datastore.Backup
Datastore.Backup allows a user create new backup snapshots and also provides the privileges of Datastore.Read and Datastore.Verify, but only if the backup group is owned by the user or one of its tokens.
...
RemoteSyncOperator
Is allowed to read data from a remote.
https://pbs.proxmox.com/docs/user-management.html#privileges

I setup my local PBS this way and cann pull my backups from my remote PBS, but maybe an even more restricive configuration would work:


pbsremote@pbs is an api token for the user, who owns the backups groups/datastore. This way I can remove the token if I ever want to remove access for my remote pbs. Please note that this permissions must be set for the user and the token.

 

[bbuster]

Thanks, i added the roll datastoreReader and now it works. Maybe i also need datastoreVerify but i will check that later