# Server backup drivers

> Where FeatherWings stores per-server backups, how to send them to Proxmox Backup Server, and the config.yml keys for compression, limits and ignore files.

Source: https://featherpanel.com/docs/wings/server-backups/

These are the backups users create from a server's Backups page, or that schedules and backup policies create for
them. For an archive of a whole node see [Node backups](https://featherpanel.com/docs/wings/node-backups).

## How the destination is chosen

The destination is set per node by the administrator, not per backup. When a backup starts, the panel calls
`GET /api/system/backups` on Wings:

- If `system.backups.pbs.enabled` is `true` and a repository or datastore is set, the backup goes to Proxmox Backup
  Server.
- Otherwise it is a local archive on the node (adapter `wings`).

The adapter is stored with the backup, so a backup made before you switched destinations is still restored from the
place it was written to.

## Local archives

Local backups are `.tar.gz` files in `system.backup_directory` (default `/var/lib/featherpanel/backups`).

```yaml
system:
  backup_directory: /var/lib/featherpanel/backups
  backups:
    compression_level: best_speed   # none, best_speed (gzip 1) or best_compression (gzip 9)
    write_limit: 0                   # MiB/s, 0 for no limit
    remove_backups_on_server_delete: true
    restore_host_allowlist: []
```

`restore_host_allowlist` lets a restore download from hosts that are otherwise blocked as private or internal. Entries
can be hostnames, IP addresses or CIDR ranges.

## Proxmox Backup Server

Install `proxmox-backup-client` on the node, then fill in `system.backups.pbs`:

```yaml
system:
  backups:
    pbs:
      enabled: true
      repository: "backup@pbs!featherpanel@pbs.example.com:datastore"
      password: "<API token secret>"
      fingerprint: ""            # optional certificate pin, leave empty for a trusted certificate
      namespace: featherpanel
      change_detection_mode: metadata
      # keyfile: /etc/featherpanel/pbs.key
      # encryption_password: ""
```

Instead of `repository` you can set `server`, `port`, `datastore` and `auth_id`. Wings passes the password,
fingerprint and encryption password to the client as `PBS_PASSWORD`, `PBS_FINGERPRINT` and `PBS_ENCRYPTION_PASSWORD`.

Each backup becomes a snapshot in the group `ct/<server uuid>` inside the namespace, with the server files in a pxar
archive named by `archive_name` (default `root.pxar`). Restart Wings after changing the file. Every key is in the
[config.yml reference](https://featherpanel.com/docs/wings/config-reference).

## Ignored files

Users can list paths to leave out when they create a backup. Wings also reads an ignore file in the root of the server,
in this order: `.featherpanelignore`, then `.pelicanignore`, then `.pteroignore`. Only the first one found is used, so
servers migrated from Pelican or Pterodactyl keep their rules.

## Other daemons

Nodes that run Calagopus Wings have their own drivers (for example S3, restic, btrfs or ZFS). The panel uses the default
adapter that daemon reports. Everything above describes FeatherWings.

## Frequently asked questions

### Can users choose where their backup goes?

No. The panel asks Wings for its default destination and uses it for every new backup on that node. Users only pick a name and ignored files.

### Does FeatherWings upload server backups to S3?

Not with FeatherPanel today. The panel endpoint that would hand out S3 upload URLs is not implemented, and FeatherWings only reports the local and PBS destinations. Use PBS, or copy the backup directory to S3 yourself.