Deploy the server
The BackupMunk server runs as a Docker Compose stack of three containers: the BackupMunk server, SurrealDB and Valkey. Your object storage isn't part of the stack. You add it later in the console (see Storage destinations). Before you start A Linux host with Docker Engine and the Docker Compose plugin. A DNS name for the server, and a TLS-terminating reverse proxy such as nginx, Traefik or Caddy. The server speaks plain HTTP on port 7500 and must not be served without TLS in front of it. Access to the image registry harbor.sageisg.com. A secrets manager or another safe place to keep the encryption key you generate in step 2. Only a few environment variables are needed to start the server. Everything else, including email, single sign-on, the public URL and the license, is configured in the web console and stored in the database. Most changes take effect without a restart. 1. Create the Compose file Create a directory for the deployment, for example /opt/backupmunk, and save this as docker-compose.yml: SurrealDB and Valkey have no published ports. Only the server reaches them, over the stack's internal network. If your reverse proxy runs on another host, change the ports line so the proxy can reach port 7500, and keep that port closed to everyone else. 2. Create the .env file Save this as .env next to docker-compose.yml, fill in the blanks, and make the file readable only by administrators: Generate the encryption key and the database password: Variable Required Purpose BACKUPMUNK_TAG Yes The image version to run. BMENT_ENC_KEY Yes Master key for everything the server encrypts at rest: 32 random bytes, base64-encoded. The server refuses to start without it. BMENT_ADMIN_PASSWORD Yes Password for the bootstrap administrator. BMENT_DB_PASSWORD Yes SurrealDB root password. BMENT_ADMIN_USERNAME No Bootstrap administrator's username. Default admin. BMENT_ADMIN_UPN No The bootstrap administrator's principal name (for example an email address). Defaults to the username. BMENT_DB_NAMESPACE, BMENT_DB_DATABASE No SurrealDB namespace and database. Defaults backupmunk and main. BMENT_REDIS_PASSWORD No Valkey password. Valkey is internal to the stack. If you set one, also add --requirepass to the Valkey command and update its health check. BMENT_LOG_LEVEL No Server log level. Default info. The bootstrap administrator's password is applied again every time the server starts. If you're ever locked out, set a new BMENT_ADMIN_PASSWORD and restart the server. Keep the encryption key safe BMENT_ENC_KEY protects the destination encryption keys, the stored storage credentials, single sign-on and SMTP secrets, and the key that signs agent tokens. [!WARNING] Generate BMENT_ENC_KEY once, before the first start, and store it in your secrets manager. Use the same value for the life of the deployment, on every restart, upgrade and new host. If the key is lost or changed, the server can't decrypt anything it sealed: it can no longer restore your backups or open its stored credentials. The only remaining way to open your backups is a destination's recovery passphrase with the bmrecover tool. A hot standby must use the same BMENT_ENC_KEY as its primary. 3. Start the stack All three containers should report healthy. The server's health endpoint is /api/v1/health. 4. Put the reverse proxy in front Point your reverse proxy at port 7500 and terminate TLS there: Forward the X-Forwarded-Proto and X-Forwarded-Host headers. In the console, open Settings → Security and turn on Trust forwarded headers, so the server knows requests arrived over HTTPS. Only turn this on behind a real reverse proxy. Agents keep a long-lived connection open to receive changes, and relayed backups stream through the server as large uploads. Make sure the proxy allows long-lived connections and large request bodies. 5. Sign in and finish setup Browse to your server's URL and sign in with the bootstrap administrator's username (or email) and password. Accept the end-user license agreement…
BackupMunk Enterprise documentation