PodHeitor Proxmox — Backup, Replication & Instant Recovery for Bacula

Complete data protection platform for Proxmox VE. VM-aware backup with Changed Block Tracking via QEMU dirty bitmaps, guest-consistent snapshots via Guest Agent, Veeam-style cross-node replication, NBD-overlay Instant Recovery in minutes, cross-hypervisor conversion (vSphere → PVE, Hyper-V → PVE), and SHA-256 fingerprint pinning to mitigate MITM. 100% Rust — FD cdylib + standalone backend, no Bacula AGPL statically linked.

Why PodHeitor Proxmox over Bacula Enterprise / Veeam?

Capability Bacula Community Veeam / Commvault PodHeitor Proxmox
VM-aware backup No Yes Yes
Changed Block Tracking (CBT) No Yes Yes (QEMU dirty-bitmap)
Native Proxmox VE integration No Limited Native (REST + NBD + QMP)
Cross-hypervisor restore No Partial vSphere → PVE, Hyper-V → PVE
Cross-node DR replication No Yes Yes, Veeam-style (PVE-1 → PVE-2)
Instant Recovery (NBD) No Yes Yes, in minutes
TLS fingerprint pinning N/A Limited SHA-256
Cost Free $$$$ ≥50% cheaper than any renewal

Backup & Recovery

  • 🔥 Full, Incremental and Differential backups of Proxmox VE VMs
  • ⚡ Changed Block Tracking (CBT) via QEMU dirty bitmaps — only changed blocks transferred
  • 📸 Guest-consistent snapshots with quiesce/freeze via QEMU Guest Agent
  • 💾 Multiple disk formats: qcow2, raw, vmdk
  • 🔁 VM configuration and firewall rules included in every job
  • 🚀 Instant Recovery (IR): spin up a VM directly from the backup stream via NBD overlay in minutes

Disaster Recovery (v1.1.0 — Veeam-style, lab-validated)

  • 🌐 Cross-node replication (PVE-1 → PVE-2) over TCP with PSK or mutual-TLS
  • 🌱 Seed (mode=seed): full initial sync, auto-provisions the replica VM on DR
  • 🔄 Incremental (mode=bitmap-push): QEMU dirty-bitmap deltas only
  • 🛡️ Integrity verification (verify_sample_blocks=N): FNV-1a-64 sample-block checksum compared between source and DR every cycle, any mismatch fails the job
  • 🗂️ Restore-point snapshots auto-rotated on DR (default 7)
  • 🎯 Planned failover (mode=failover-exec): one command boots replica on DR
  • ↩️ Planned failback (mode=failback-pre): returns replica to standby
  • 🏗️ Automatic VM provisioning on the DR target node (cores, RAM, NICs, SCSI)
  • 🔑 Mutual TLS client-cert auth (rustls + PEM) or PSK shared-secret mode
  • ⚙️ Standalone DR receiver daemon (systemd template — no bacula-fd needed on DR)
  • 📊 Dashboard JSON emitter for Prometheus / custom monitoring integration

Cross-Hypervisor Conversion

  • 🔄 vSphere → Proxmox VE: restore VMware VMs (VMDK format) directly into PVE
  • 🔄 Hyper-V → Proxmox VE: restore Hyper-V VMs (VHDX format) directly into PVE
  • 🗂️ qcow2, raw, vmdk output formats supported at restore time

Security

  • 🔒 TLS Fingerprint Pinning: SHA-256 certificate fingerprint validation prevents MITM attacks against the PVE API
  • 🛡️ DR authentication tokens and TLS mutual authentication for the DR channel
  • 🔐 No credentials stored in cleartext on disk (parameters via Bacula Director)
  • 🚫 pve_insecure flag (default: no) — TLS verification is enforced by default

Operations

  • 🤖 Wildcard VM selection (vm=* backs up all VMs automatically)
  • 🚫 Exclusion lists (exclude=101,102,test-vm) for precise control
  • 🏊 Resource pool support for multi-tenant environments
  • 🖥️ Multi-node aware: specify exact PVE node or auto-detect

Compatibility

  • Bacula Community 15.0.3+
  • Proxmox VE 8.4+ / 9.x
  • Linux x86_64 (.deb and .rpm)
  • Rust 1.95+ (build), no runtime dependency

Installation

# Debian / Ubuntu
sudo dpkg -i podheitor-proxmox-plugin_1.1.0-1_amd64.deb

# RHEL / Oracle Linux / Rocky / Alma
sudo dnf install podheitor-proxmox-plugin-1.1.0-1.el9.x86_64.rpm

The package installs the cdylib in /opt/bacula/plugins/, the backend and CLI in /opt/bacula/bin/, optional systemd units for the DR receiver, and FileSet/Director examples.

Ready to switch?

Bring us your renewal or new-contract proposal from Bacula Enterprise, Veeam, Commvault or NetBackup. We commit to a minimum 50% discount, with more capabilities included.

Heitor Faria — Founder, PodHeitor International
✉ [email protected]
☎ +1 (789) 726-1749 · +55 (61) 98268-4220 (WhatsApp)
Free 30-day commercial trial.

Technical whitepaper

📘 Read the full technical whitepaper — architecture, backup modes, integrations, anti-patterns and licensing model.

Disponível em: pt-brPortuguês (Portuguese (Brazil))enEnglishesEspañol (Spanish)