Install the Backup Server
What you need, the one command that installs it, and the short setup wizard. Then how to get your phone and computer onto its private VPN.
On this page
You install the Backup Server on its own machine, not on the server you want to protect. It takes one command and a short wizard in your browser.
What you need#
- A second machine. A small VPS is plenty to start with, and so is a spare computer in another building. What matters is disk space: about as much as the data you want to protect, plus room for history.
- Debian 13. That's what the installer is made for. It installs the packages it needs, including WireGuard and a firewall.
- Root access (or
sudo), and a way to reach the machine's console from your provider in case you ever lock yourself out. - A public address and one open UDP port, for the VPN. The installer finds the address by itself and uses UDP port 51820.
- A password manager. You'll be given a master password. If you lose it, you lose the way to open the stored backup passwords. Keeping it safe explains what that means.
Run the installer#
On the new machine, as root (or with sudo), run:
curl -fsSL https://get.libreportal.org/librebackup | bash
The installer checks the signature of the release before it installs anything. It sets up the VPN, the firewall, the backup storage and the panel. It ends by printing a setup address, a setup code and the certificate fingerprint.
If you want to choose the public address yourself, add it after bash -s --:
curl -fsSL https://get.libreportal.org/librebackup | bash -s -- --endpoint 203.0.113.5:51820
Use your own public address and the VPN port.
Read the end of the output
The installer says it finished even when a step failed, so read the end. Look for the lines starting Panel:, Firewall: and Done., and for any line starting with warning:. If one of the first three is missing, a step failed. The installer's log is in /var/log/backupserver/install.log.
Check the certificate#
Open the setup address in a browser. It will warn about the certificate, because the Backup Server made it for itself. That is expected.
Compare the fingerprint
Compare the fingerprint the installer printed with the one your browser shows for the certificate. If they match, you're talking to your own machine, and it's safe to carry on.
A server with only a public address, like most VPSes, shows the setup page on that public address for a short time, protected by the setup code. The window closes after 2 hours and its firewall rule is removed. If you need more time, run sudo librebackup setup reopen on the machine. It opens the window again with a new code.
The setup wizard#
The wizard asks for these in order. Nothing is applied until the last button.
- Setup code. The one the installer printed. It stops anyone else who finds the page from setting up your server.
- Your account. A name for this server, and the username and password you'll sign in to the panel with (at least 12 characters).
- Master password. Let it generate a strong one, or type your own. Put it in your password manager now. It locks the stored backup passwords, and it isn't kept anywhere on the server.
- VPN devices. Add your phone and your computer. Each gets its WireGuard settings and a QR code, shown once.
- How is it reached. VPN only is the recommended choice. Local network and Public internet are there for special cases and are marked less safe. With VPN only, SSH is limited to the VPN as well, unless you switch that off.
- Connect over the VPN. If you chose VPN only, switch the tunnel on from one of your devices and open the one-time address the page shows. The page checks by itself every few seconds. It proves the whole path works before anything is locked down, and it's what unlocks Finish.
- Ready to finish. A summary and one button.
After Finish, the panel moves to its VPN address. Open the confirm address the page shows, from a device that's on the VPN, within 5 minutes. If you don't, the Backup Server puts everything back the way it was, so a mistake can't lock you out for good.
Why the wizard makes you connect over the VPN first
Once the panel is VPN-only, a device that can't get onto the VPN can't reach it at all. Asking you to prove a device works first, and to confirm afterwards, means you find out about a problem while the way back is still open.
Get onto its VPN#
The Backup Server runs its own WireGuard VPN, separate from your LibrePortal's. A new server picks a random free range inside 100.64.0.0/10, such as 100.66.12.0/24, and the panel lives at the first address in it, on port 8080. The wizard shows the address.
Each device you add needs the official WireGuard app. The steps are the same as for your LibrePortal's own VPN, so follow the one for your device on Connect a device to your VPN, using the QR code or file from the wizard instead.
Why that range
Phone VPN apps with a firewall, such as RethinkDNS with Do not route Private IPs switched on, send every 10.x, 172.16.x and 192.168.x address around the tunnel. A server on one of those ranges would be out of reach. The 100.64.0.0/10 range isn't on that list, so the tunnel works with the setting on and your home network keeps working. The Backup Server leaves out 100.64.0.0/15, which RethinkDNS uses for itself.
On a phone with RethinkDNS. RethinkDNS can hold several WireGuard tunnels at once, so add the Backup Server's tunnel next to your LibrePortal one. Make sure your browser is added to the tunnel and isn't set to Bypass. The VPN page has the rest.
Servers installed before this range existed are on 10.44.0.0/24. They can move to a new one, as described in Keeping it safe.
If you get locked out#
Use your provider's web console, or the machine's own keyboard, and run:
sudo librebackup access set local --lan-address 192.168.1.50
Give the machine's own address on your home network. It puts the panel back on that network and opens SSH again. sudo librebackup access show tells you where things stand.
Next: connect an install.