Pass every node in --host: one archive per node, all in the same dated folder.
Up and running in 4 steps
- Install cv4pve-node-protect
- Set up SSH access
- Run
cv4pve-node-protect backup - Check the archive
Back up the configuration of your Proxmox VE nodes
Runs outside the nodes, over SSH. One tar.gz per node with the files you choose, from /etc/network/interfaces to the cluster database, in dated folders with automatic retention.
By sysadmins, for sysadmins.
Built by Corsinvest, official Proxmox partner.
arch=$(uname -m | sed 's/x86_64/x64/;s/aarch64/arm64/;s/armv7l/arm/')wget https://github.com/Corsinvest/cv4pve-node-protect/releases/latest/download/cv4pve-node-protect-linux-$arch.zipunzip cv4pve-node-protect-linux-$arch.zipchmod +x cv4pve-node-protect./cv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7curl -s https://api.github.com/repos/Corsinvest/cv4pve-node-protect/releases/latest | grep -o "https://[^\"]*-$(dpkg --print-architecture)\.deb" | xargs curl -LOsudo dpkg -i cv4pve-node-protect-*-$(dpkg --print-architecture).debcv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7curl -s https://api.github.com/repos/Corsinvest/cv4pve-node-protect/releases/latest | grep -o "https://[^\"]*-$(rpm --eval %_target_cpu)\.rpm" | xargs curl -LOsudo rpm -i cv4pve-node-protect-*-$(rpm --eval %_target_cpu).rpmcv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7yay -S cv4pve-node-protectcv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7brew install corsinvest/tap/cv4pve-node-protectcv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7curl -s https://api.github.com/repos/Corsinvest/cv4pve-node-protect/releases/latest | grep -o "https://[^\"]*-$(uname -m)\.pkg" | xargs curl -LOsudo installer -target / -pkg cv4pve-node-protect-*-$(uname -m).pkgcv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7arch=$(uname -m | sed 's/x86_64/x64/')curl -LO https://github.com/Corsinvest/cv4pve-node-protect/releases/latest/download/cv4pve-node-protect-osx-$arch.zipunzip cv4pve-node-protect-osx-$arch.zipchmod +x cv4pve-node-protect./cv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7winget install Corsinvest.cv4pve.nodeprotectcv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7$arch = @{ AMD64 = 'x64'; x86 = 'x86'; ARM64 = 'arm64' }[$env:PROCESSOR_ARCHITECTURE]Invoke-WebRequest https://github.com/Corsinvest/cv4pve-node-protect/releases/latest/download/cv4pve-node-protect.exe-win-$arch.zip -OutFile cv4pve-node-protect.zipExpand-Archive cv4pve-node-protect.zip -DestinationPath . -Force.\cv4pve-node-protect --host=pve01,pve02,pve03 --username=root --private-key-file=id_ed25519 backup --paths='/etc/.;/etc/pve/.;/var/lib/pve-cluster/.' --directory-work=. --keep=7One archive per node, in a folder named after the date and time of the run:
ACTION BackupKeep: 7Directory Work: .Directory Node to archive:/etc/./etc/pve/./var/lib/pve-cluster/.Create config: 2026-09-29-03-00-01/pve01-config.tar.gzCreate config: 2026-09-29-03-00-01/pve02-config.tar.gzCreate config: 2026-09-29-03-00-01/pve03-config.tar.gz
The settings of the run, the paths archived on each node, then one line for each archive written.
Proxmox VE backup jobs save your VMs and containers, not the node they run on. The node has its own
configuration: bridges, bonds and VLANs in /etc/network/interfaces, /etc/hosts, storage
definitions, the cluster configuration in /etc/pve, certificates, SSH keys, apt repositories,
kernel parameters, the cron jobs and scripts you added.
When a node’s boot disk dies, or someone breaks a file by mistake, that configuration has to come back. Rebuilding it by hand from memory and screenshots is slow and easy to get wrong: a bridge with a different name, a missing VLAN, and guests do not start on the reinstalled node.
cv4pve-node-protect copies those files from every node into a dated tar.gz, on a schedule, so you
can compare what changed and put back exactly what was there.
Where it fits
Section titled “Where it fits”The cv4pve suite follows the Unix philosophy: each tool does one thing and does it well. cv4pve-node-protect protects the node, the other tools the guests and the knowledge of the cluster.
| Tool | Protects | How |
|---|---|---|
| cv4pve-node-protect | Node configuration files | SSH, tar.gz per node |
| Proxmox VE backup / Proxmox Backup Server | VMs and containers | Built into Proxmox VE |
| cv4pve-autosnap | VM and container snapshots on a schedule | Proxmox VE API |
| cv4pve-report | A readable inventory of the cluster, to document it | Proxmox VE API |
Prefer a web interface with scheduled backups? cv4pve-admin runs the same engine as its Node Protect module.
Outside the nodes, over SSH
Section titled “Outside the nodes, over SSH”cv4pve-node-protect runs outside the cluster (on your workstation, a management VM or the machine
that keeps your backups) and connects to each node over SSH, not through the Proxmox VE API.
On every node it runs a single tar command and streams the archive back; nothing is installed and
nothing is written on the node.
Reading the whole configuration needs root, and the archives hold secrets such as /etc/shadow,
SSH keys and storage passwords. SSH access and security
explains the account, the host key and how to keep the archives safe: read it before the first run.
What an archive contains
Section titled “What an archive contains”One run with the recommended paths on a node of our test cluster, grouped (about 1 MB compressed):
| Part | Examples |
|---|---|
| Network | /etc/network/interfaces, /etc/hosts, /etc/hostname, /etc/resolv.conf |
| System | /etc/fstab, /etc/kernel/cmdline, /etc/modprobe.d/, /etc/apt/sources.list.d/, /etc/vzdump.conf, /etc/zfs/, /etc/lvm/ |
| Cluster | /etc/corosync/corosync.conf, and /var/lib/pve-cluster/config.db: the database behind /etc/pve |
/etc/pve as files |
storage.cfg, datacenter.cfg, user.cfg, jobs.cfg, firewall rules, guest configurations, node certificates pve-ssl.pem / pve-ssl.key, priv/ |
| Accounts and keys | /etc/shadow, SSH host keys, /root/.ssh/, /var/spool/cron/crontabs/ |
What it does for you
Section titled “What it does for you”/etc, the readable /etc/pve files, the cluster database, crontabs, root SSH keys, your own scripts.
tar writes to the SSH channel and the archive lands straight in your local file: no temporary files, no agent.
--keep removes the oldest dated folders after each run, and never touches other folders.
Plain tar.gz files: extract to a staging folder, compare, then put back only what you need.
cron or Task Scheduler, an options file for the connection, exit code 1 when a run fails.
Part of the cv4pve suite →
Made by Corsinvest,
official Proxmox partner
Take your first node backup
Download the binary, point it at your nodes over SSH, open the archive.
Made by Corsinvest,official Proxmox partner
