Plakar on Ubuntu 24.04 on Azure User Guide

Overview

Plakar is an open source backup engine for creating distributed, versioned backups with compression, encryption and content addressed data deduplication. Backups are written into a Kloset store, where identical data is stored exactly once no matter how many snapshots reference it, so keeping a long history costs a fraction of the space that repeated full backups would. Every snapshot is independently restorable and independently integrity checkable, and Plakar ships a built in web interface for browsing a snapshot, comparing it against another and restoring files without touching the command line.

The cloudimg image serves Plakar 1.1.4 behind an nginx reverse proxy on a hardened, fully patched Ubuntu 24.04 LTS base. Plakar is a single self contained static Go binary that embeds its own web interface, so there is no runtime interpreter and no external dependency. The Plakar server listens only on the loopback interface (127.0.0.1:9090) and nginx serves it on port 80.

Two secrets are generated uniquely on the first boot of every VM and written to a root only file: the repository passphrase that encrypts the Kloset store, and the web interface token that guards the API. Nothing cryptographic ships inside the image, so no two deployments share a key and no one holding the image can read your backups. Backed by 24/7 cloudimg support.

What is included:

• Plakar 1.1.4 served behind nginx, managed by systemd
• A per VM repository encryption passphrase generated on first boot and recorded in a root only file
• A per VM web interface token generated on first boot, with the API rejecting unauthenticated and wrong token requests
• An encrypted Kloset repository initialised on first boot at /var/lib/plakar/kloset
• The Plakar server bound to 127.0.0.1:9090 only, never exposed directly to the network
• A dedicated Azure data disk at /var/lib/plakar for the repository, independently resizable and separate from the OS disk
• plakar-selftest, a shipped end to end verification that performs a real backup, a real restore to a separate path and a byte for byte checksum comparison
• plakar-ui.service and nginx.service as enabled systemd units
• The complete Plakar manual pages (man plakar, man plakar-backup, and the rest)
• 24/7 cloudimg support

Plakar is licensed under the ISC licence. This image bundles the unmodified upstream Plakar binary and is not affiliated with or endorsed by the Plakar project.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region. Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point; size up for heavier backup workloads, and resize the data disk for larger repositories. NSG inbound: allow 22/tcp from your management network and 80/tcp for the web interface. Plakar serves plain HTTP on port 80; for production, terminate TLS in front of it with your own domain. The Plakar server is never exposed directly: it listens on 127.0.0.1:9090 only, so port 9090 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Plakar by cloudimg, and select Create. On Basics pick your subscription, resource group, region and size; under Administrator account choose SSH public key and paste your key; under Inbound port rules allow SSH (22) and HTTP (80). Review the dedicated data disk on the Disks tab, then Review + create then Create.

Step 2 - Deploy from the Azure CLI

az vm create \
  --resource-group <your-rg> \
  --name plakar \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 to the web interface:

az vm open-port --resource-group <your-rg> --name plakar --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm Plakar and nginx are active. Note that the Plakar server listens only on 127.0.0.1:9090 while nginx serves the web interface on port 80.

systemctl is-active plakar-ui nginx plakar-firstboot

Confirm the installed version:

plakar version

Confirm that port 9090 is bound to loopback only, and that nginx is the sole public listener:

sudo ss -tlnp | grep -E ':80 |:9090 '

Step 4 - Retrieve the per VM passphrase and token

Both secrets are generated on the first boot of this VM and written to a root only file. Copy the repository passphrase somewhere safe now. It is the only thing that can decrypt your backups; if it is lost, your snapshots are unrecoverable and cloudimg cannot recover them for you.

sudo cat /root/plakar-credentials.txt

The file lists the web interface URL (with the token embedded), the token on its own, the repository path, and the repository passphrase. Confirm the file is readable only by root:

sudo ls -l /root/plakar-credentials.txt

Step 5 - Open the web interface

Browse to the plakar.url value from the credentials file. It has the form http://<PLAKAR_HOST>/?plakar_token=<PLAKAR_UI_TOKEN> — the token in the query string is handed to the interface on first load and kept in your browser's local storage for subsequent API calls.

The dashboard shows the repository summary: total snapshots, logical size against actual storage size (the difference is what deduplication and compression saved you), and the Kloset store panel with the chunking algorithm, the compression algorithm and the encryption algorithm in use.

If you open the interface without the token, or with the wrong one, the API returns 401 Unauthorized and the interface presents a token sign in form instead of your data.

Step 6 - Take your first backup

Plakar runs as the plakar service account and reads the repository passphrase from /etc/plakar/passphrase, so the passphrase never appears in a command line or in ps output. The at keyword selects which Kloset store to operate on.

Create something to back up:

sudo -u plakar mkdir -p /var/lib/plakar/sources/example
sudo -u plakar sh -c 'echo "hello from cloudimg" > /var/lib/plakar/sources/example/hello.txt'

Back it up:

sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset backup /var/lib/plakar/sources/example

List the snapshots in the repository:

sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset ls

Each row shows the timestamp, the short snapshot ID, the logical size, the duration and the source path. Verify the integrity of everything in the repository, which recomputes and checks the message authentication codes on all stored data:

sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset check

Step 7 - Browse and restore snapshots in the web interface

Select Snapshots in the sidebar to see every snapshot in the repository. Because Plakar deduplicates, a second backup of a barely changed source adds almost nothing to the stored size even though it is a complete, independently restorable snapshot.

Select a snapshot to browse its contents. You get the full file tree as it was at that moment, with sizes, modification times and ownership, and can download any file or directory directly from the interface.

The Kloset store panel documents the cryptography in use. Plakar encrypts with AES256-GCM-SIV, and the repository can only be opened with the correct passphrase — without it the data is inaccessible, including to anyone who obtains a copy of the underlying disk.

Step 8 - Restore from the command line and verify it

A backup you have never restored is not yet a backup. Restore a snapshot to a separate path and compare the result against the original.

Take the short snapshot ID from the ls output in Step 6, then restore it somewhere new. Run this from a directory the plakar service account can read — plakar restore inspects the current working directory, so starting from your home directory would fail with stat .: permission denied:

cd /var/lib/plakar
SNAP=$(sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset ls | awk '$NF=="/var/lib/plakar/sources/example"{s=$2} END{print s}')
echo "restoring snapshot ${SNAP}"
sudo -u plakar mkdir -p /var/lib/plakar/sources/restored
sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset restore -to /var/lib/plakar/sources/restored "${SNAP}"

Confirm the restored content matches the original byte for byte:

sudo diff -r /var/lib/plakar/sources/example /var/lib/plakar/sources/restored && echo "RESTORE VERIFIED: identical"

Step 9 - Verify the whole appliance

The image ships plakar-selftest, which exercises the entire path end to end against your real repository and fails loudly if any part of it is wrong. It writes a known dataset, backs it up, restores it to a different path, compares every file by sha256, runs a full integrity check, and then confirms four negative controls: a wrong passphrase must not open the repository, a bogus snapshot ID must not restore anything, and the API must reject both unauthenticated and wrong token requests.

sudo plakar-selftest

Run it whenever you want assurance that the appliance is healthy — after a resize, after a restore, or on a schedule.

Step 10 - Where your data lives

/var/lib/plakar is a dedicated Azure data disk, separate from the OS disk and independently resizable and snapshottable.

df -h /var/lib/plakar

To grow the repository, resize the data disk in the Azure portal and then grow the filesystem with sudo resize2fs /dev/disk/azure/scsi1/lun0.

Security notes

• The repository passphrase is generated per VM on first boot and is never baked into the image. A backup appliance that shipped a shared passphrase would let anyone holding the image read every customer's backups. Nothing cryptographic exists in the image: the repository, the passphrase and the token are all created on the first boot of your VM.
• Back up the passphrase off the VM. It is the only thing that can decrypt your snapshots. cloudimg cannot recover it.
• The passphrase is readable by the plakar service account (0640 root:plakar) because the always on web interface must be able to open the encrypted repository. This is inherent to any always on backup appliance. If you would rather no long lived key sat on the VM at all, disable plakar-ui.service and drive Plakar from the command line, supplying the passphrase per invocation.
• The web interface API requires the per VM token. Requests with no token or a wrong token are rejected with 401 Unauthorized. The -no-auth flag, which would disable authentication entirely, is never used by this image.
• The Plakar server is bound to 127.0.0.1:9090 and is not reachable from the network. nginx on port 80 is the only public listener. Keep port 9090 closed in your NSG.
• Terminate TLS in production. The interface is served over plain HTTP; put your own certificate in front of it before exposing it beyond a trusted network.
• Restrict 22/tcp to your management network, and treat /root/plakar-credentials.txt as sensitive.
• The image is fully patched at build time and unattended-upgrades remains enabled, so security updates continue to be applied on your VM.

Support

24/7 support is included with this image. Contact support@cloudimg.co.uk with the Azure Marketplace offer name and your VM's region and size. For Plakar itself, see the upstream documentation and the manual pages installed on the image (man plakar).