Storage Azure

Barman on Ubuntu 24.04 on Azure User Guide

Last updated: 2026-07-19 | Product: Barman PostgreSQL Backup and Recovery Manager on Ubuntu 24.04 LTS on Azure

Overview

This guide covers the deployment and use of Barman on Ubuntu 24.04 on Azure using cloudimg Azure Marketplace images. Barman (Backup and Recovery Manager) is the open source disaster recovery manager for PostgreSQL from EnterpriseDB. It takes scheduled physical base backups, continuously streams the write ahead log so you can recover to any point in time, enforces retention policies, and drives full restores, all from a single command line catalogue.

To make the appliance useful the moment it boots, the image also installs a local PostgreSQL 16 instance (from the official PostgreSQL PGDG repository) and configures it as a fully working demo backup source. On first boot Barman wires itself to that PostgreSQL, takes a first base backup and starts streaming WAL, so you can see a real, working backup catalogue immediately and then point Barman at your own production PostgreSQL servers.

Backup topology — streaming, the most robust choice for a single VM. Barman uses backup_method = postgres, which drives pg_basebackup over a streaming replication connection, so there are no ssh keys and no archive_command to manage. WAL is streamed continuously into the catalogue via pg_receivewal against a named replication slot, which guarantees PostgreSQL keeps every WAL segment until Barman has safely received it.

Security by design — loopback only, no public database port. The bundled PostgreSQL listens on 127.0.0.1 only. The image opens only TCP 22 in its Network Security Group; there is no public database port to attack. Barman reaches PostgreSQL entirely over the loopback interface.

Security by design — no baked credential. Nothing is baked into the image. On first boot the PostgreSQL superuser and the barman (management) and streaming_barman (replication) roles each receive an independent random password. Those passwords are written to the barman user's ~/.pgpass (/var/lib/barman/.pgpass, mode 0600), so Barman authenticates automatically, and a root only summary is written to /root/barman-credentials.txt. The PostgreSQL data directory is reset when the image is built, so every deployed VM starts from a clean cluster with fresh credentials.

What is included:

Barman (Backup and Recovery Manager) from the PostgreSQL PGDG repository, driven by the barman command line
A bundled local PostgreSQL 16 instance configured as a demo backup source, listening on the loopback interface only
backup_method = postgres streaming base backups, plus continuous WAL streaming into the catalogue through a replication slot
Scheduled backups by cron: WAL streaming maintenance every minute and a base backup daily at 01:30
Per VM PostgreSQL credentials generated on first boot, stored in the barman user's ~/.pgpass and summarised in a root only file, never baked into the image
A first base backup taken automatically on first boot so the catalogue is populated immediately
Unattended security upgrades left enabled so the appliance keeps receiving patches

Prerequisites

Active Azure subscription, SSH public key, VNet + subnet in the target region
Subscription to the Barman listing on Azure Marketplace
A Network Security Group rule allowing TCP 22 (admin) from your management network. No database port is exposed by this appliance.

Recommended virtual machine size: Standard_B2s (2 vCPU, 4 GB RAM) for the demo and light backup workloads. For protecting larger production databases, use Standard_D2s_v5 or larger and attach a data disk sized for your backup retention.

Step 1: Deploy from the Azure Portal

Search Barman in Marketplace, select the cloudimg publisher, and click Create. Configure the Network Security Group to allow TCP 22 for administration from your management network. No inbound database port is required — the bundled PostgreSQL is loopback only.

Step 2: Deploy from the Azure CLI

RG="backup-prod"; LOCATION="eastus"; VM_NAME="barman1"
GALLERY_IMAGE_ID="/subscriptions/<sub-id>/resourceGroups/azure-cloudimg/providers/Microsoft.Compute/galleries/cloudimgGallery/images/barman-ubuntu-24-04/versions/<version>"
SSH_KEY="$(cat ~/.ssh/id_rsa.pub)"
az group create --name "$RG" --location "$LOCATION"
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$GALLERY_IMAGE_ID" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open only the admin port on the VM's NSG:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1001

Step 3: First boot

On first boot the image starts PostgreSQL on the loopback interface, generates a per VM password for each database role, writes the barman user's ~/.pgpass, creates the replication slot, starts WAL streaming, takes the first base backup, and writes /root/barman-credentials.txt. This completes within a minute. SSH in as azureuser and read the details:

sudo cat /root/barman-credentials.txt

Step 4: Confirm the backup source and Barman are healthy

The bundled PostgreSQL is active, and barman check pg verifies the whole backup chain end to end: the management and streaming connections, the WAL level, the replication slot, WAL streaming (receive-wal running), the pg_basebackup tooling, and the minimum redundancy policy. Every line must read OK.

systemctl is-active postgresql.service
sudo -u barman barman check pg

PostgreSQL reports active and barman check pg prints every check as OK including PostgreSQL, PostgreSQL streaming, wal_level, replication slot, receive-wal running, pg_basebackup and minimum redundancy requirements, confirming the backup source and WAL streaming are healthy

Step 5: List the backup catalogue

barman list-backup shows every base backup Barman holds for the server. The first backup was taken automatically on first boot; the daily cron job adds a new one at 01:30.

sudo -u barman barman list-backup pg

barman list-backup pg lists the base backup taken on first boot with its backup id, status F for a full backup, the completion time, the backup size and the WAL size

Step 6: Inspect a backup

barman show-backup prints the full detail of a backup: the PostgreSQL version and system id, the backup method, the size, the WAL range it spans, and the retention policy status.

sudo -u barman barman show-backup pg latest

barman show-backup pg latest prints the detail of the latest backup including status DONE, the PostgreSQL version, the backup method postgres, the estimated cluster size, the begin and end WAL, the LSN range and the retention policy shown as VALID

Step 7: Take a backup on demand

Backups run automatically on a schedule, but you can take one at any time. Barman streams a fresh base backup from PostgreSQL and records it in the catalogue.

sudo -u barman barman backup pg

Step 8: Restore a backup to a directory

This is the recovery half of Barman. barman recover rebuilds a complete PostgreSQL data directory from a chosen backup plus the WAL needed to make it consistent. Here we restore the latest backup into a scratch directory to verify the recovery works end to end (clearing the target first so the command is repeatable).

sudo -u barman rm -rf /var/tmp/barman-restore-demo
sudo -u barman barman recover pg latest /var/tmp/barman-restore-demo

Barman prints a WARNING that postgresql.conf, pg_hba.conf and pg_ident.conf were not restored. This is expected on Ubuntu: PostgreSQL keeps its configuration under /etc/postgresql, outside the data directory, so it is not part of a physical backup. Copy your own configuration into place before starting a recovered instance. The recovered data directory itself is complete and valid.

barman recover pg latest restores the latest backup into the scratch directory, copies the base backup and the required WAL segments, notes that the postgresql configuration files live outside the data directory and prints that the PostgreSQL server has been successfully prepared for recovery

Step 9: Protect your own PostgreSQL servers

The bundled PostgreSQL is a working demo. To back up your own PostgreSQL servers, add a Barman server definition under /etc/barman.d/ for each one. A streaming definition looks like this:

[myserver]
description = "Production PostgreSQL"
conninfo = host=db.example.internal user=barman dbname=postgres
streaming_conninfo = host=db.example.internal user=streaming_barman dbname=postgres
backup_method = postgres
streaming_archiver = on
slot_name = barman
create_slot = auto
retention_policy = REDUNDANCY 7

Create the matching barman and streaming_barman roles on the target PostgreSQL, add their passwords to /var/lib/barman/.pgpass, then verify and take a first backup:

sudo -u barman barman receive-wal --create-slot myserver
sudo -u barman barman cron
sudo -u barman barman check myserver
sudo -u barman barman backup myserver

Step 10: Scheduled backups and WAL streaming

The appliance ships two cron jobs. barman cron runs every minute to keep WAL streaming alive and process the archive; a base backup runs daily at 01:30. Review or adjust the schedule in /etc/cron.d/barman.

cat /etc/cron.d/barman

Step 11: Security recommendations

Keep the database private. The bundled PostgreSQL is loopback only and no database port is exposed. If you attach additional databases, reach them over a private VNet, never a public address.
Restrict the NSG. Allow TCP 22 only from your management network.
Protect the backup catalogue. Barman's catalogue under /var/lib/barman contains your data. Restrict access to the VM and consider attaching an encrypted data disk sized for your retention policy.
Set a retention policy that matches your recovery objectives. The demo keeps two backups (retention_policy = REDUNDANCY 2); production servers usually want more. Adjust per server in /etc/barman.d/.
Test your restores. A backup you have never restored is not a backup. Use barman recover (Step 8) regularly to prove your recovery path.
Keep the OS and Barman patched. Unattended security upgrades remain enabled on the running VM.

Step 12: Support and Licensing

Barman is developed by EnterpriseDB and distributed under the GPL 3.0 license. This cloudimg image bundles the unmodified PGDG Barman and PostgreSQL packages. cloudimg provides the packaging, the secure by default loopback only configuration, the streaming backup and WAL topology, the first boot credential generation, and 24/7 support with a guaranteed 24 hour response SLA.

cloudimg is not affiliated with or endorsed by EnterpriseDB. Barman and PostgreSQL are marks of their respective owners and are used here only to identify the software.

Deploy on Azure

Find Barman on Ubuntu 24.04 LTS on the Azure Marketplace, published by cloudimg. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email support@cloudimg.co.uk for deployment help, configuration questions, or licensing enquiries.