Deployment guide

Plakar

Overview

Plakar is an open source backup engine that creates distributed, versioned backups with compression, encryption and content-addressed deduplication. Backups are written into a Kloset store, where identical data is stored exactly once no matter how many snapshots reference it. A long history therefore costs a fraction of the space that repeated full backups would.

Every snapshot is independently restorable and independently integrity-checkable. Plakar also ships a built-in web interface for browsing a snapshot, comparing it against another and restoring files without the command line.

This SecureAnyCloud image serves Plakar 1.1.4 behind an nginx reverse proxy on a hardened Ubuntu 24.04 LTS base, patched at build time. Plakar is a single, self-contained static Go binary that embeds its own web interface, so there is no runtime interpreter and no external dependency. The Plakar server listens only on the loopback interface (127.0.0.1:9090), and nginx serves it on port 80.

Two secrets are generated uniquely on the first boot of every VM and written to a root-only file: the repository passphrase that encrypts the Kloset store, and the web interface token that guards the API. Nothing cryptographic ships inside the image, so no two deployments share a key and no one holding the image can read your backups.

What you get:

Plakar 1.1.4 served behind nginx, managed by systemd
A per-VM repository encryption passphrase, generated on first boot and recorded in a root-only file
A per-VM web interface token, generated on first boot, with the API rejecting unauthenticated and wrong-token requests
An encrypted Kloset repository, initialized on first boot at /var/lib/plakar/kloset
The Plakar server bound to 127.0.0.1:9090 only, never exposed directly to the network
A dedicated Azure data disk at /var/lib/plakar for the repository, independently resizable and separate from the OS disk
plakar-selftest, an end-to-end verification that performs a real backup, a real restore to a separate path and a byte-for-byte checksum comparison
plakar-ui.service and nginx.service as enabled systemd units
The complete Plakar manual pages (man plakar, man plakar-backup, and the rest)
24/7 SecureAnyCloud support

Plakar is licensed under the ISC license. This image bundles the unmodified upstream Plakar binary and is not affiliated with or endorsed by the Plakar project.

Prerequisites

An active Azure subscription, an SSH key pair, and a VNet plus subnet in the target region
Standard_B2s (2 vCPU / 4 GiB RAM) is a sensible starting point. Size up for heavier backup workloads, and resize the data disk for larger repositories.
NSG inbound rules: allow 22/tcp from your management network and 80/tcp for the web interface
Plakar serves plain HTTP on port 80. For production, terminate TLS in front of it with your own domain.
The Plakar server is never exposed directly. It listens on 127.0.0.1:9090 only, so port 9090 stays off the network.

Step 1 - Deploy from the Azure Marketplace

Sign in to the Azure Portal, choose Create a resource, search the Marketplace for Plakar by SecureAnyCloud, and select Create.

On the Basics tab, pick your subscription, resource group, region and size. Under Administrator account, choose SSH public key and paste your key. Under Inbound port rules, allow SSH (22) and HTTP (80).

Review the dedicated data disk on the Disks tab, then select Review + create and Create.

Step 2 - Deploy from the Azure CLI

Create the VM with the Azure CLI:

az vm create \
  --resource-group <your-rg> \
  --name plakar \
  --image <marketplace-image-urn> \
  --size Standard_B2s \
  --admin-username azureuser \
  --generate-ssh-keys \
  --public-ip-sku Standard

Then open port 80 for the web interface:

az vm open-port --resource-group <your-rg> --name plakar --port 80

Step 3 - Confirm the services are running

SSH in as azureuser and confirm that Plakar and nginx are active. The Plakar server listens only on 127.0.0.1:9090, and nginx serves the web interface on port 80.

systemctl is-active plakar-ui nginx plakar-firstboot

Confirm the installed version:

plakar version

Confirm that port 9090 is bound to loopback only, and that nginx is the sole public listener:

sudo ss -tlnp | grep -E ':80 |:9090 '

Step 4 - Retrieve the per-VM passphrase and token

Both secrets are generated on the first boot of this VM and written to a root-only file. Copy the repository passphrase somewhere safe now. It is the only thing that can decrypt your backups. If it is lost, your snapshots are unrecoverable and SecureAnyCloud cannot recover them for you.

sudo cat /root/plakar-credentials.txt

The file lists the web interface URL (with the token embedded), the token on its own, the repository path and the repository passphrase. Confirm that the file is readable only by root:

sudo ls -l /root/plakar-credentials.txt

Step 5 - Open the web interface

Browse to the plakar.url value from the credentials file. It has the form http://<PLAKAR_HOST>/?plakar_token=<PLAKAR_UI_TOKEN>. The token in the query string is handed to the interface on first load and kept in your browser's local storage for subsequent API calls.

The dashboard shows the repository summary: total snapshots, logical size against actual storage size, and the Kloset store panel. The difference between logical and actual size is what deduplication and compression saved you. The Kloset store panel shows the chunking, compression and encryption algorithms in use.

If you open the interface without the token, or with the wrong one, the API returns 401 Unauthorized. The interface then shows a token sign-in form instead of your data.

Step 6 - Take your first backup

Plakar runs as the plakar service account and reads the repository passphrase from /etc/plakar/passphrase, so the passphrase never appears in a command line or in ps output. The at keyword selects the Kloset store to operate on.

Create something to back up:

sudo -u plakar mkdir -p /var/lib/plakar/sources/example
sudo -u plakar sh -c 'echo "hello from sac" > /var/lib/plakar/sources/example/hello.txt'

Back it up:

sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset backup /var/lib/plakar/sources/example

List the snapshots in the repository:

sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset ls

Each row shows the timestamp, the short snapshot ID, the logical size, the duration and the source path.

Verify the integrity of everything in the repository. This recomputes and checks the message authentication codes on all stored data:

sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset check

Step 7 - Browse and restore snapshots in the web interface

Select Snapshots in the sidebar to see every snapshot in the repository. Because Plakar deduplicates, a second backup of a barely changed source adds almost nothing to the stored size, even though it is a complete, independently restorable snapshot.

Select a snapshot to browse its contents. You see the full file tree as it was at that moment, with sizes, modification times and ownership. You can download any file or directory directly from the interface.

The Kloset store panel shows the cryptography in use. Plakar encrypts with AES256-GCM-SIV, and the repository can only be opened with the correct passphrase. Without it, the data is inaccessible, including to anyone who obtains a copy of the underlying disk.

Step 8 - Restore from the command line and verify it

A backup you have never restored is not yet a backup. Restore a snapshot to a separate path and compare the result against the original.

Take the short snapshot ID from the ls output in Step 6, then restore it to a new location. Run the command from a directory that the plakar service account can read. plakar restore inspects the current working directory, so starting from your home directory fails with stat .: permission denied:

cd /var/lib/plakar
SNAP=$(sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset ls | awk '$NF=="/var/lib/plakar/sources/example"{s=$2} END{print s}')
echo "restoring snapshot ${SNAP}"
sudo -u plakar mkdir -p /var/lib/plakar/sources/restored
sudo -u plakar HOME=/var/lib/plakar plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset restore -to /var/lib/plakar/sources/restored "${SNAP}"

Confirm that the restored content matches the original byte for byte:

sudo diff -r /var/lib/plakar/sources/example /var/lib/plakar/sources/restored && echo "RESTORE VERIFIED: identical"

Step 9 - Verify the whole appliance

The image ships plakar-selftest, which exercises the entire path end to end against your real repository and fails loudly if any part of it is wrong. It writes a known dataset, backs it up, restores it to a different path, compares every file by sha256 and runs a full integrity check.

It then confirms four negative controls. A wrong passphrase must not open the repository, a bogus snapshot ID must not restore anything, and the API must reject both unauthenticated and wrong-token requests.

sudo plakar-selftest

Run it whenever you want to confirm that the appliance is healthy: after a resize, after a restore, or on a schedule.

Step 10 - Where your data lives

/var/lib/plakar is a dedicated Azure data disk. It is separate from the OS disk and can be resized and snapshotted independently. Check its size and usage:

df -h /var/lib/plakar

The image uses these paths:

/var/lib/plakar/kloset: the encrypted Kloset repository, with all snapshot data, states and packfiles
/var/lib/plakar/sources: a suggested location for staging data you intend to back up
/etc/plakar/passphrase: the per-VM repository passphrase, readable by root and the plakar service account
/etc/plakar/ui.env: the per-VM web interface token
/root/plakar-credentials.txt: both secrets plus the interface URL, readable by root only
/usr/local/bin/plakar: the Plakar binary
/usr/local/sbin/plakar-selftest: the end-to-end verification script

To grow the repository, resize the data disk in the Azure portal, then grow the filesystem with sudo resize2fs /dev/disk/azure/scsi1/lun0.

Security notes

The repository passphrase is generated per VM on first boot and is never baked into the image. A backup appliance that shipped a shared passphrase would let anyone holding the image read every customer's backups. Nothing cryptographic exists in the image: the repository, the passphrase and the token are all created on the first boot of your VM.
Back up the passphrase off the VM. It is the only thing that can decrypt your snapshots, and SecureAnyCloud cannot recover it.
The passphrase is readable by the plakar service account (0640 root:plakar) because the always-on web interface must be able to open the encrypted repository. This is inherent to any always-on backup appliance. If you prefer that no long-lived key sits on the VM, disable plakar-ui.service and drive Plakar from the command line, supplying the passphrase per invocation.
The web interface API requires the per-VM token. Requests with no token or a wrong token are rejected with 401 Unauthorized. This image never uses the -no-auth flag, which would disable authentication entirely.
The Plakar server is bound to 127.0.0.1:9090 and is not reachable from the network. nginx on port 80 is the only public listener. Keep port 9090 closed in your NSG.
Terminate TLS in production. The interface is served over plain HTTP. Put your own certificate in front of it before exposing it beyond a trusted network.
Restrict 22/tcp to your management network, and treat /root/plakar-credentials.txt as sensitive.
The image is fully patched at build time, and unattended-upgrades remains enabled, so security updates continue to be applied on your VM.

Support

24/7 support is included with this image. Contact sales@secureanycloud.com with the Azure Marketplace offer name and your VM's region and size.

For Plakar itself, see the upstream documentation and the manual pages installed on the image (man plakar).

Deploy on Azure

Launch Plakar on Ubuntu 24.04 LTS on Azure with 24/7 support from SecureAnyCloud.

View this image

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on Azure

Overview

This SecureAnyCloud AMI runs Plakar, the open source backup engine that creates versioned backups with compression, encryption and content-addressed deduplication. Snapshots land in a Kloset store, where identical data is kept exactly once however many snapshots reference it. A long retention history therefore costs a fraction of repeated full backups.

What you get:

Plakar as a single static binary that embeds its own web interface
The web interface running as a persistent service bound to the loopback interface on 127.0.0.1:9090, reached through nginx on port 80
The Kloset repository at /var/lib/plakar/kloset on a dedicated EBS volume, separate from the operating system disk and independently resizable
A repository encryption passphrase and a web interface access token that every instance generates for itself on first boot
No cryptographic material inside the image, so no two deployments can read each other's backups

The repository passphrase never leaves your instance. It is generated on your own machine at first boot, and SecureAnyCloud holds no copy. It is the only thing that can decrypt your snapshots. If you lose it, those snapshots are unrecoverable by anyone, including us. Record it somewhere safe the first time you log in.

Prerequisites

Before you deploy this image, you need:

An Amazon Web Services account where you can launch EC2 instances
IAM permissions to launch instances, create security groups and subscribe to AWS Marketplace products
An EC2 key pair in the target Region for SSH access to the instance
A VPC and subnet in the target Region, with a security group that allows inbound port 22 from your management network and inbound port 80 from the networks your operators will use to reach the web interface
The AWS CLI (version 2) installed locally, if you plan to deploy from the command line

Launch the Instance from the AWS Marketplace

Sign in to the AWS Management Console, open the EC2 service, and select Launch instance. Under Application and OS Images, choose AWS Marketplace AMIs and search for Plakar. Select the SecureAnyCloud listing, choose Select, then choose Continue on the subscription summary.

Pick an instance type of m5.large or larger. Choose your EC2 key pair under Key pair (login). Under Network settings, select your VPC and subnet, then create or select a security group. The group must allow inbound port 22 from your management network and inbound port 80 from the networks your operators use.

Leave the root volume at the default size or larger. Size the additional repository volume to the amount of backup history you intend to retain.

Select Launch instance. First-boot initialization takes about one minute after the instance state becomes Running. During that time, Plakar generates the per-instance passphrase and token and initializes a fresh encrypted repository.

Launch the Instance from the AWS CLI

The following command launches an instance from the SecureAnyCloud Plakar Marketplace AMI into an existing subnet and security group. Replace <ami-id> with the AMI ID shown on the Marketplace listing, <key-name> with your EC2 key pair name, <subnet-id> with your subnet ID, and <security-group-id> with a security group that opens ports 22 and 80 as described above.

aws ec2 run-instances \
  --image-id <ami-id> \
  --instance-type m5.large \
  --key-name <key-name> \
  --subnet-id <subnet-id> \
  --security-group-ids <security-group-id> \
  --tag-specifications 'ResourceType=instance,Tags=[{Key=Name,Value=plakar-01}]'

On success, the command prints a JSON document. Note the instance ID, then retrieve the public address once the instance is running with aws ec2 describe-instances --instance-ids <instance-id> --query "Reservations[].Instances[].PublicIpAddress" --output text.

Connect to Your Instance

Connect over SSH with the key pair you selected and the public IP address from step 2. The SSH login user depends on the operating system of the AMI variant you launched:

Plakar 1.1.4 on Ubuntu 24.04: ubuntu

Confirm that the stack is running and serving. Both units are enabled, so they start again automatically after a reboot.

systemctl is-active plakar-ui.service nginx.service curl -s -o /dev/null -w 'plakar web interface HTTP %{http_code}\n' -m 15 http://127.0.0.1/

Two active lines and HTTP 200 confirm that Plakar and nginx are both serving.

Retrieve the Per Instance Credentials

First boot writes the repository passphrase, the web interface token and a ready-made sign-in URL to a root-only file. Confirm that the file is present, has the right permissions and carries the expected entries. This command prints only the entry names, never their values, so your secrets do not end up in a terminal log:

sudo stat -c 'mode=%a owner=%U:%G' /root/plakar-credentials.txt
sudo grep -oE '^plakar\.(host|url|ui\.token|repository\.path|repository\.passphrase)=' /root/plakar-credentials.txt | sed 's/=$//'

You should see mode=600 owner=root:root and the five entry names listed.

To read the actual values, including the web interface URL with the token already embedded, run the following on your instance. Treat the output as sensitive, and do not paste it into shared logs or tickets:

sudo cat /root/plakar-credentials.txt

The plakar.url entry is a complete link of the form http://<public-ip>/?plakar_token=<token>. Opening it hands the token to the web interface for you.

Verify the API Rejects Unauthenticated Access

Every /api/* route is guarded by a bearer token. The static interface itself is served without authentication, but no data can be read without the token. Test all three cases in one command. The token is read into a shell variable and never printed:

TOKEN="$(sudo sed -n 's/^plakar.ui.token=//p' /root/plakar-credentials.txt)" [ -n "$TOKEN" ] || { echo "FAIL: no token in the credentials file"; exit 1; } printf 'no token -> '; curl -s -o /dev/null -w '%{http_code}\n' -m 15 http://127.0.0.1/api/info printf 'wrong token -> '; curl -s -o /dev/null -w '%{http_code}\n' -m 15 -H "Authorization: Bearer wrong-$TOKEN" http://127.0.0.1/api/info printf 'correct token -> '; curl -s -o /dev/null -w '%{http_code}\n' -m 15 -H "Authorization: Bearer $TOKEN" http://127.0.0.1/api/info

The expected result is 401, 401, 200. The first two show that neither a missing nor an incorrect token can read your backup metadata. The third shows that your generated token works.

Confirm the Repository Is on Its Dedicated Volume

The encrypted repository lives on its own EBS volume, so you can grow your backup history without touching the operating system disk. The volume is mounted from /etc/fstab by filesystem UUID, which is stable across reboots and across relaunching the AMI:

findmnt -no SOURCE,TARGET,FSTYPE,OPTIONS /var/lib/plakar df -h /var/lib/plakar | tail -1

You see an ext4 filesystem mounted at /var/lib/plakar. To grow it later, expand the EBS volume in the AWS console, then run sudo resize2fs against the device shown by the command above.

Open the Web Interface

Open a web browser and go to the plakar.url value from step 4, which is http://<public-ip>/?plakar_token=<token>. That link hands the token to the interface, and the dashboard loads directly.

The dashboard summarizes your repository. It shows how many snapshots the repository holds, the logical size of the protected data against the actual storage used after deduplication and compression, and the repository's cryptographic parameters.

The Kloset store panel in the sidebar shows the repository location, the chunking algorithm, the compression codec and the encryption cipher in use. Use it to confirm that your data is encrypted at rest.

Browse Snapshots

Select Snapshots in the sidebar to see every snapshot in the repository, each with its identifier, source path, age, size and item count.

Select any snapshot to browse its contents exactly as they were when the backup ran, with the original file modes, ownership and timestamps preserved.

Open a directory to reach individual files. The percentage beside each size shows that file's share of the snapshot. The Version selector at the top lets you compare the same path across different snapshots.

Select the checkbox beside any file or directory, then use the download control at the top right. This restores just that item through the browser, without a command-line restore of the whole snapshot.

Verify the Appliance End to End

A backup system is only worth what it can restore. The image ships a self test that exercises the whole path rather than checking a version string. It writes a known dataset, backs it up into your real encrypted repository, restores it to a different location, and compares every restored file against the original by checksum.

It then runs a full integrity check and exercises four negative controls, each of which must fail. A wrong passphrase must not open the repository, a bogus snapshot identifier must not restore, an unauthenticated API call must be refused, and a wrong token must be refused. Run the self test:

sudo /usr/local/sbin/plakar-selftest

A selftest OK line followed by SELFTEST_SUCCESS means that backup, restore, byte-for-byte integrity, encryption and API authentication all work on this instance. You can re-run the self test at any time, because it only ever adds its own small snapshot. Run it after any change to the instance and as part of your disaster recovery drills.

Back Up Your Own Data

Plakar reads the repository passphrase from the keyfile at /etc/plakar/passphrase through the -keyfile flag, which keeps it out of the process list. Run backups as the plakar service account, so that ownership and cache locations stay consistent with the web interface service.

To back up a directory:

sudo -u plakar HOME=/var/lib/plakar plakar \
  -keyfile /etc/plakar/passphrase \
  at /var/lib/plakar/kloset \
  backup /path/to/your/data

To list the snapshots in the repository:

sudo -u plakar HOME=/var/lib/plakar plakar \
  -keyfile /etc/plakar/passphrase \
  at /var/lib/plakar/kloset \
  ls

To restore a snapshot to a chosen location, use the snapshot identifier from the listing above:

sudo -u plakar HOME=/var/lib/plakar plakar \
  -keyfile /etc/plakar/passphrase \
  at /var/lib/plakar/kloset \
  restore -to <backup-dir> <snapshot-id>

To verify the integrity of everything in the repository:

sudo -u plakar HOME=/var/lib/plakar plakar \
  -keyfile /etc/plakar/passphrase \
  at /var/lib/plakar/kloset \
  check

Restoring to a path that already holds data overwrites files at that path. Restore to an empty directory first, then move the recovered files into place once you have inspected them.

Schedule Regular Backups

This image has no built-in Plakar scheduler, so use systemd timers. Create a unit that runs your backup command and a timer that triggers it. The following is a starting point to adapt. Write these files with your preferred editor, and adjust the path you are protecting:

# /etc/systemd/system/plakar-backup.service [Unit] Description=Plakar scheduled backup After=network-online.target [Service] Type=oneshot User=plakar Environment="HOME=/var/lib/plakar" ExecStart=/usr/local/bin/plakar -keyfile /etc/plakar/passphrase at /var/lib/plakar/kloset backup /path/to/your/data

# /etc/systemd/system/plakar-backup.timer [Unit] Description=Run the Plakar backup daily [Timer] OnCalendar=daily Persistent=true [Install] WantedBy=timers.target

Enable the timer with sudo systemctl daemon-reload followed by sudo systemctl enable --now plakar-backup.timer. Confirm the schedule with systemctl list-timers plakar-backup.timer.

Manage Retention

Deduplication makes history cheap, but not free. Plakar can remove snapshots you no longer need and reclaim the space their unique data occupied. Review what you hold before removing anything, because removal cannot be undone. To remove a snapshot:

sudo -u plakar HOME=/var/lib/plakar plakar \
  -keyfile /etc/plakar/passphrase \
  at /var/lib/plakar/kloset \
  rm <snapshot-id>

After removing snapshots, reclaim the freed space:

sudo -u plakar HOME=/var/lib/plakar plakar \
  -keyfile /etc/plakar/passphrase \
  at /var/lib/plakar/kloset \
  maintenance

Run a check afterwards to confirm that the repository is still consistent. Keep the self test in your routine so you always know that your restores work.

Securing the Deployment

The image is hardened by default. Confirm the following for a production deployment:

Restrict port 80. The web interface is reached over plain HTTP on port 80. Limit the security group to the networks your operators use instead of leaving it open to the internet.
Add TLS. For anything beyond a private management network, terminate HTTPS in front of the interface. Point a DNS name at the instance and obtain a certificate with Let's Encrypt, or place the instance behind an Application Load Balancer with an ACM certificate.
Protect the token. Anyone holding the web interface token can read your backup metadata and restore your files. Treat the credentials file as a secret. If the token is ever exposed, rotate it by editing /etc/plakar/ui.env and restarting the interface.
Back up the passphrase, not just the data. The repository is useless without its passphrase. Store it in your password manager or secrets service the day you launch the instance.
The Plakar service never listens on the network. It binds to 127.0.0.1:9090 and is reachable only through nginx. Do not open port 9090 in the security group.

Support

SecureAnyCloud supports this image. Email sales@secureanycloud.com with your instance ID and AWS Region for help with deployment, repository and volume sizing, restore procedures, TLS termination and version upgrades.

Plakar is open source under the ISC license, and the license notice is retained on the image at /usr/share/doc/plakar/LICENSE. There is no license fee. The SecureAnyCloud charge covers packaging, security patching, image maintenance and support.

Plakar is a trademark of its respective owner, and SecureAnyCloud is not affiliated with or endorsed by the Plakar project.

Deploy on AWS

Launch Plakar on AWS with 24/7 support from SecureAnyCloud.

View on Marketplace

Need Help?

Our support team is available 24/7.

sales@secureanycloud.com

Deploy on AWS