Installation

Everything installs under /opt/backup/. Packages come from the gated NGBackup repository at get.ngbackup.com - your repository login is created free at ngbackup.com/get-repo.html (the same password signs you into the website and the repo).

The fast path: one command

After registering, your account page shows this command with your credentials pre-filled - run it on the machine you want to set up:

curl -fsSL https://get.ngbackup.com/install.sh | sudo bash

A wizard asks for your repository login and what this machine should be:

Role	What you get
Full server	Director + Storage + Client + CLI console + Web Console on one host
Storage node	Storage Daemon, enrolled with your Director automatically
Client only	File Daemon, enrolled with your Director automatically

plus any plugins (PostgreSQL, MySQL, Oracle, MSSQL, MongoDB, Firebird, ADABAS, Microsoft 365, Nutanix, CloudStack, Proxmox, SFTP, vSphere, Granular Restore) and cloud storage drivers (S3, Azure, GCS, OCI).

A full server also installs the Web Console - a browser UI on port 9180. It needs a one-time setup (a Postgres database and one env edit) that the installer prints at the end; then systemctl enable --now backupweb and browse http://<host>:9180 (first login admin / admin). Add --no-web to skip it, or --web to force it on a non-server role.

For Storage and Client roles the installer runs open enrollment: it asks only for the Director address and a name for this node, the daemon enrolls itself over TLS, both sides seal the shared password, the firewall port (9102/9103) opens, and the systemd service (ngbackup-fd / ngbackup-sd) is installed and enabled. No token to mint or paste. Re-running the command upgrades packages; an already-enrolled daemon is left alone.

Fleet / non-interactive use - pass the Director address and a name:

curl -fsSL https://get.ngbackup.com/install.sh | sudo bash -s -- \
  --user [email protected] --pass 'REPO-PASSWORD' --role client \
  --director dir.example.com:9101 --name web-01

Supported today: RHEL/Rocky/Alma 9, Debian 12 (bookworm), Ubuntu 22.04 (jammy) / 24.04 (noble). Windows clients: see Protect another machine below.

Manual repository setup

Prefer to manage sources yourself? After logging in, the repository landing page at get.ngbackup.com shows copy-paste apt and dnf snippets (signing key, per-module sources, credentials kept out of URLs). The core package is ngbackup (Director + Storage Daemon + File Daemon + console + secrets tool); plugins are ngbackup-plugin-<name> and cloud drivers ngbackup-cloud-driver-<name>.

Setting up a full server

The one-command installer (role Full server) does the entire setup - there are no manual steps:

curl -fsSL https://get.ngbackup.com/install.sh | sudo bash -s -- \
  --user [email protected] --pass 'REPO-PASSWORD' --role server --web

On a full-server install the ngbackup-dir package post-install automatically:

provisions the PostgreSQL catalog (creates the ngbackup role + database and builds the schema with backup-dbutil);
fills the daemon configs in /opt/backup/etc/ with generated secrets;
starts the Director, Storage Daemon and File Daemon services; and
with --web, brings up the web console (its own database, migrated, admin user seeded) at http://<host>:9180 (log in as admin / admin, change on first login).

PostgreSQL is the production catalog backend. (MySQL/MariaDB and SQLite backends are implemented and conformance-tested but not selectable in the shipping build - available on special order.)

To re-provision the catalog by hand (e.g. against a remote database), point the Catalog{} block in /opt/backup/etc/backup-dir.conf at it and run:

sudo -u postgres /opt/backup/bin/backup-dbutil create-database -c /opt/backup/etc/backup-dir.conf
sudo -u postgres /opt/backup/bin/backup-dbutil grant-privileges -c /opt/backup/etc/backup-dir.conf
/opt/backup/bin/backup-dbutil make-tables -c /opt/backup/etc/backup-dir.conf

Review the configuration

Configuration lives in /opt/backup/etc/:

File	Service
`backup-dir.conf`	Director
`backup-sd.conf`	Storage Daemon
`backup-fd.conf`	File Daemon
`backup-console.conf`	Console

Validate a config before starting a service:

/opt/backup/bin/backup-dir -t -c /opt/backup/etc/backup-dir.conf

On packaged installs the post-install generates the daemon passwords, renders them directly into the .conf files (mode 640, root:backup) and keeps a copy in /opt/backup/etc/.ngbackup-secrets (mode 600). Treat the whole /opt/backup/etc/ directory as sensitive. The sealed secret store (@secret: references in the configs, unlocked by /opt/backup/etc/master.key - see Secrets & encrypted config) is supported by every daemon and by backup-dbutil, but packaged installs do not yet seal by default.

All daemons run as systemd services (ngbackup-dir, ngbackup-sd, ngbackup-fd, and backupweb for the console) and are started for you. Confirm the Director answers:

systemctl status ngbackup-dir
/opt/backup/bin/backup-console
* status director

(Director ports: 9101; File Daemon 9102; Storage Daemon 9103; Web Console 9180.)

Protect another machine

On each machine you want to back up, the Client only role of the one-command installer does everything: packages, enrollment (the Director auto-creates the Client, both sides seal a shared password), firewall, service. No config editing, no hand-carried password.

Linux - curl -fsSL https://get.ngbackup.com/install.sh | sudo bash → Client only. (Or run the bundled wizard directly: sudo /opt/backup/bin/install-ngbackup-fd.sh.)
Windows - run the graphical setup wizard (NGBackup-fd-Setup-<version>-win64.exe from get.ngbackup.com/windows/x64/): the Connect page has two fields, Director enrollment endpoint (host:port) and Name for this client. It installs the service, opens the firewall and enrolls. No command line. Silent: NGBackup-fd-Setup.exe /S /DIRECTOR=dir.example.com:9101 /NAME=web-01.

Or enroll from the command line after installing the packages - give the Director address and a name, no token:

backup-fd --enroll --director dir.example.com:9101 --name web-01
backup-fd     # start the daemon (daemon mode is the default - no flags needed)

A storage node is the same procedure with backup-sd and its optional disk device flags:

backup-sd --enroll --director dir.example.com:9101 --name store-01 \
  --archive-device /opt/backup/storage --rw-devices 10 --ro-devices 2

This is open enrollment: the daemon presents just the name over TLS and the Director creates the resource. It is on by default (AllowOpenEnrollment = yes in the Director resource). Set that directive to no to require a pre-minted token instead - see Operate → Node enrollment for the token path.

Enrollment runs over TLS, so give the Director a TlsCertificate/TlsKey; without a certificate the handshake is refused. Pass --director-fingerprint <sha256> to pin that certificate, or omit it for trust-on-first-use.

See Operate → Node enrollment for the full flow. Enrollment creates the Client or Storage for you - you don’t add one by hand.

License and support

By downloading, installing, or using NGBackup you accept the End-User License Agreement & Confidentiality Terms. Installing the software constitutes acceptance.

The free / community edition is provided as is, with no support, no warranty and no liability. Paid support and warranties, if any, are available only under a separate commercial subscription.
NGBackup is proprietary software, licensed not sold. The software, your repository credentials, and non-public documentation are confidential and must not be shared or redistributed.
Reverse engineering (except where the law expressly permits) and any use intended to harm the project are prohibited.

The one-command installer shows this notice and records your acceptance (interactive runs confirm with accept; automated runs pass --accept-eula).

Next: run your first backup in Getting started.