Barman

Search the Azure Marketplace for Barman, select the SecureAnyCloud publisher, and click Create.

Configure the Network Security Group to allow TCP 22 for administration from your management network. You need no inbound database port, because the bundled PostgreSQL is loopback only.

RG="backup-prod"; LOCATION="eastus"; VM_NAME="barman1" IMAGE_URN="sac1647283583153:barman-ubuntu-24-04:default:latest" SSH_KEY="$(cat ~/.ssh/id_rsa.pub)" az group create --name "$RG" --location "$LOCATION"
# Accept the Marketplace terms once per subscription (required before the first CLI deploy)
az vm image terms accept --urn sac1647283583153:barman-ubuntu-24-04:default:latest
az vm create \
  --resource-group "$RG" --name "$VM_NAME" \
  --image "$IMAGE_URN" \
  --size Standard_B2s \
  --admin-username azureuser \
  --ssh-key-values "$SSH_KEY" \
  --public-ip-sku Standard
# Open only the admin port on the VM's NSG:
az vm open-port --resource-group "$RG" --name "$VM_NAME" --port 22 --priority 1001

On first boot, the image does the following:

• Starts PostgreSQL on the loopback interface
• Generates a per-VM password for each database role
• Writes the barman user's ~/.pgpass
• Creates the replication slot and starts WAL streaming
• Takes the first base backup
• Writes /root/barman-credentials.txt

This completes within a minute. SSH in as azureuser and read the details:

sudo cat /root/barman-credentials.txt

The bundled PostgreSQL is active. barman check pg verifies the whole backup chain end to end: the management and streaming connections, the WAL level, the replication slot, WAL streaming (receive-wal running), the pg_basebackup tooling, and the minimum redundancy policy. Every line must read OK.

systemctl is-active postgresql.service
sudo -u barman barman check pg

barman list-backup shows every base backup Barman holds for the server. The image took the first backup automatically on first boot, and the daily cron job adds a new one at 01:30.

sudo -u barman barman list-backup pg

barman show-backup prints the full detail of a backup: the PostgreSQL version and system ID, the backup method, the size, the WAL range it spans, and the retention policy status.

sudo -u barman barman show-backup pg latest

Backups run automatically on a schedule, and you can also take one at any time. Barman streams a fresh base backup from PostgreSQL and records it in the catalogue.

sudo -u barman barman backup pg

Recovery is the other half of Barman. barman recover rebuilds a complete PostgreSQL data directory from a chosen backup plus the WAL needed to make it consistent.

The command below restores the latest backup into a scratch directory, to verify that recovery works end to end. It clears the target first, so you can repeat it.

sudo -u barman rm -rf /var/tmp/barman-restore-demo
sudo -u barman barman recover pg latest /var/tmp/barman-restore-demo

Barman prints a WARNING that postgresql.conf, pg_hba.conf and pg_ident.conf were not restored. This is expected on Ubuntu. PostgreSQL keeps its configuration under /etc/postgresql, outside the data directory, so it is not part of a physical backup.

Copy your own configuration into place before you start a recovered instance. The recovered data directory itself is complete and valid.

The bundled PostgreSQL is a working demo. To back up your own PostgreSQL servers, add a Barman server definition under /etc/barman.d/ for each one. A streaming definition looks like this:

[myserver] description = "Production PostgreSQL" conninfo = host=db.example.internal user=barman dbname=postgres streaming_conninfo = host=db.example.internal user=streaming_barman dbname=postgres backup_method = postgres streaming_archiver = on slot_name = barman create_slot = auto retention_policy = REDUNDANCY 7

Create the matching barman and streaming_barman roles on the target PostgreSQL, add their passwords to /var/lib/barman/.pgpass, then verify and take a first backup:

sudo -u barman barman receive-wal --create-slot myserver
sudo -u barman barman cron
sudo -u barman barman check myserver
sudo -u barman barman backup myserver

The appliance ships two cron jobs. barman cron runs every minute to keep WAL streaming alive and process the archive, and a base backup runs daily at 01:30. Review or adjust the schedule in /etc/cron.d/barman.

cat /etc/cron.d/barman

• Keep the database private. The bundled PostgreSQL is loopback only, and no database port is exposed. If you attach additional databases, reach them over a private VNet, never a public address.
• Restrict the NSG. Allow TCP 22 only from your management network.
• Protect the backup catalogue. Barman's catalogue under /var/lib/barman contains your data. Restrict access to the VM, and consider attaching an encrypted data disk sized for your retention policy.
• Set a retention policy that matches your recovery objectives. The demo keeps two backups (retention_policy = REDUNDANCY 2), and production servers usually want more. Adjust the policy per server in /etc/barman.d/.
• Test your restores. A backup you have never restored is not a backup. Use barman recover (Step 8) regularly to prove your recovery path.
• Keep the OS and Barman patched. Unattended security upgrades remain enabled on the running VM.

Barman is developed by EnterpriseDB and distributed under the GPL 3.0 license. This SecureAnyCloud image bundles the unmodified PGDG Barman and PostgreSQL packages.

SecureAnyCloud provides the packaging, the secure-by-default loopback-only configuration, the streaming backup and WAL topology, the first-boot credential generation, and 24/7 support with a guaranteed 24-hour response SLA.

SecureAnyCloud is not affiliated with or endorsed by EnterpriseDB. Barman and PostgreSQL are marks of their respective owners and are used here only to identify the software.

Deploy on Azure

Find Barman on Ubuntu 24.04 LTS on the Azure Marketplace, published by SecureAnyCloud. Deploy from the Portal or the Azure CLI as shown above.

Need Help?

Email sales@secureanycloud.com for deployment help, configuration questions, or licensing enquiries.

Deploy on Azure

Launch Barman PostgreSQL Backup and Recovery Manager on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Barman. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, and create or select a security group that allows inbound port 22 from your management network. The image attaches the dedicated Barman catalogue volume automatically.

Select Launch instance. First-boot initialisation runs once, after the instance state becomes Running and the status checks pass. It brings up PostgreSQL, rotates the per-instance passwords, creates the replication slot, takes the first base backup and verifies backup health. This takes a minute or two.

The command below launches an instance from the SecureAnyCloud Barman Marketplace AMI into an existing subnet and security group. Make these replacements first:

• Replace <ami-id> with the AMI ID shown on the Marketplace listing.
• Replace <key-name> with your EC2 key pair name.
• Replace <sub-id> with your subnet ID.
• Replace <security-group-id> with a security group that opens port 22 from your management network.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <sub-id> \
  --security-group-ids <security-group-id> \
  --metadata-options HttpTokens=required \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=barman}]'

When the instance reaches the Running state and its status checks pass, note its public IP address or DNS name from the EC2 console or with aws ec2 describe-instances.

Connect over SSH using your key pair and the login user for your operating system variant. For Ubuntu 24.04, the login user is ubuntu.

ssh -i <key-name>.pem ubuntu@<public-ip>

The message of the day summarises the key Barman commands. Run everyday Barman commands as the barman system user, via sudo -u barman.

Barman's check command verifies every part of the backup pipeline for a server: the PostgreSQL connection, backup privileges, streaming replication, the WAL level, the replication slot, WAL streaming (receive-wal), the archiver, and the retention policy. On this image, the bundled server is named pg.

systemctl is-active postgresql@16-main.service
sudo -u barman barman check pg

Every line should report OK. This confirms that the backup source and WAL streaming are healthy.

The image takes a base backup automatically on first boot. List the catalogue and inspect the most recent backup. The catalogue lives on the dedicated EBS volume mounted at /var/lib/barman.

sudo -u barman barman list-backup pg
sudo -u barman barman show-backup pg latest

show-backup reports the backup status (DONE), the backup method (postgres, meaning a streaming pg_basebackup), the PostgreSQL version, and the estimated size.

You can take a base backup at any time. A scheduled base backup also runs daily at 01:30 by cron, and barman cron maintains WAL streaming every minute.

sudo -u barman barman switch-wal --force --archive pg
sudo -u barman barman backup pg --wait sudo -u barman barman list-backup pg

barman recover restores a chosen backup, plus the WAL needed to reach a target time, into a target directory. The result is a ready-to-start PostgreSQL data directory. The example restores the latest backup into /var/tmp/restore.

sudo rm -rf /var/tmp/restore
sudo install -d -o barman -g barman /var/tmp/restore
sudo -u barman barman recover pg latest /var/tmp/restore
sudo ls /var/tmp/restore

To recover to a specific moment instead of the latest state, add --target-time "YYYY-MM-DD HH:MM:SS".

On Debian and Ubuntu, the PostgreSQL configuration files live under /etc/postgresql/16/main. Copy them alongside the recovered data directory, or supply a config_file, before you start the recovered cluster.

The Barman catalogue is stored on a dedicated EBS volume, separate from the operating system disk, so your backups are isolated, easy to snapshot off-instance, and simple to resize.

df -h /var/lib/barman findmnt /var/lib/barman

The mount is defined by filesystem UUID in /etc/fstab, so it re-attaches automatically on every boot. Use Amazon EBS Snapshots to copy the catalogue off-instance. To increase capacity, grow the volume in the EC2 console and extend the filesystem.

The bundled pg server is a working demonstration. To protect your production databases, take these steps:

• Add a Barman server configuration under /etc/barman.d/ that points at your PostgreSQL host.
• Grant Barman a replication connection on that host.
• Open network reachability from this instance to your database, with a security group rule for the PostgreSQL port (typically 5432) on the private network.

Barman can manage many servers from this one host, each with its own retention policy. See the official Barman documentation for the streaming and rsync/SSH backup methods and for multi-server topologies.