Onboard a Bareos client: File Daemon, TLS and the first backup job

Starting point and goal

Part 1 built the Bareos server with Director, Storage Daemon, PostgreSQL catalog, bconsole and WebUI. This part connects client01.example.test as a separate Debian 13 system over the private lab network.

An installed File Daemon is not yet an onboarded client. Matching resource names and secrets, a reachable private address, valid Director configuration and an executed backup job provide the required evidence.

• Bareos server: bareos01.example.test at 192.168.77.10.
• Client: client01.example.test at 192.168.77.11.
• Bareos community build 25.1.2~pre49.d5742f640 from the official Debian 13 repository.
• Administrative lab account: fone-rumboldm with fone-admins.
• Test scope: connection, estimate and a full backup of isolated test data.

1. Add the repository and install the File Daemon

Client and server should use compatible Bareos channels. The lab therefore uses the same official current repository on both hosts. Review the installer and record the package version actually installed.

sudo apt-get update
sudo apt-get install -y ca-certificates curl gnupg
curl -fsSLo /tmp/add_bareos_repositories.sh https://download.bareos.org/current/Debian_13/add_bareos_repositories.sh
less /tmp/add_bareos_repositories.sh
sudo sh /tmp/add_bareos_repositories.sh
sudo apt-get update
sudo apt-get install -y bareos-filedaemon
dpkg-query -W bareos-filedaemon bareos-common

2. Configure the client identity and Director access

The File Daemon client resource uses a unique name and binds only to the private lab address. Plugin Names is deliberately empty because the test does not require plugins.

The Director resource authorizes bareos-dir with a dedicated random secret. The same secret is configured in the Director client resource and belongs in secret management. The real connection negotiated TLS 1.3 with CHACHA20-POLY1305.

sudoedit /etc/bareos/bareos-fd.d/client/myself.conf

Client {
  Name = client01-fd
  FD Address = 192.168.77.11
  Plugin Names = ""
}

sudoedit /etc/bareos/bareos-fd.d/director/bareos-dir.conf

Director {
  Name = bareos-dir
  Password = "<SECRET_FROM_SECRET_MANAGEMENT>"
}

3. Add the client resource to the Director

The Director needs the counterpart to the File Daemon configuration. Name, address and secret must match exactly. Use an internally resolvable address or fixed private IP, never localhost for a remote client.

sudoedit /etc/bareos/bareos-dir.d/client/client01-fd.conf

Client {
  Name = client01-fd
  Address = 192.168.77.11
  Password = "<SAME_SECRET_AS_ON_CLIENT>"
  Maximum Concurrent Jobs = 5
}

4. Define a limited FileSet

The first acceptance test protects a small controlled directory rather than the whole system. This makes the expected files explicit and limits the impact of a wrong include path. ACL and extended-attribute support are enabled.

sudo install -d -m 0755 /srv/bareos-test/subdirectory
printf "%s\n" "ForgeOne Bareos client onboarding test" | sudo tee /srv/bareos-test/README.txt

sudoedit /etc/bareos/bareos-dir.d/fileset/client01-test.conf

FileSet {
  Name = "client01-test"
  Include {
    Options {
      Signature = XXH128
      Acl Support = yes
      Xattr Support = yes
    }
    File = /srv/bareos-test
  }
}

5. Connect the backup job to the existing JobDefs

The job reuses the verified DefaultJob resource and overrides client, FileSet and Full pool. A production schedule should only be enabled after RPO, maintenance window and retention have been agreed.

sudoedit /etc/bareos/bareos-dir.d/job/backup-client01.conf

Job {
  Name = "backup-client01"
  JobDefs = "DefaultJob"
  Client = "client01-fd"
  FileSet = "client01-test"
  Pool = "Full"
}

6. Validate both configurations before restart

Validate the File Daemon first and the Director second. Reload services only after clean checks. Deprecated warnings also need correction; the lab removed one obsolete File Daemon directive before acceptance.

sudo bareos-fd -t
sudo systemctl restart bareos-filedaemon
systemctl is-active bareos-filedaemon

# Auf dem Director
sudo -u bareos bareos-dir -t
sudo systemctl reload bareos-director

7. Verify connection and selection with bconsole

status client verifies authentication, protocol and reachability. estimate evaluates the FileSet without writing a backup. The lab negotiated Immediate TLS with TLS 1.3 and reported five filesystem entries with 135 bytes of payload.

sudo -u bareos bconsole
status client=client01-fd
estimate job=backup-client01 level=Full
quit

8. Run the full backup and read the result

The first full job used isolated test data. Bareos created volume Full-0001, wrote five entries and reported OK for both File and Storage Daemons. Job status T means successfully terminated.

A successful backup does not yet prove recoverability. It confirms the Director-to-client, client-to-storage and catalog path. The next part performs an isolated restore with content and metadata comparison.

sudo -u bareos bconsole
run job=backup-client01 level=Full yes
wait
messages
list jobs client=client01-fd last
quit

Troubleshoot failures methodically

Authentication failed usually points to mismatching resource names or secrets. Connection refused suggests an inactive daemon, incorrect bind address or firewall rule. A successful Director connection with a failed job can indicate the separate path to the Storage Daemon.

• Compare Director and File Daemon resource names and secrets exactly.
• Confirm that the File Daemon listens on the intended private address and port 9102.
• Test routing from Director to client and from client to storage separately.
• Run bareos-fd -t and bareos-dir -t before interpreting logs.
• Correlate Director, File Daemon and Storage messages by job ID.
• Do not work around TLS problems by disabling encryption; correct trust and naming.

https://bareos01.example.test/bareos-webui/client/details?client=client01-fd

https://bareos01.example.test/bareos-webui/job/details/2

https://bareos01.example.test/bareos-webui/job/details/2

bareos01.example.test

Technical acceptance of client onboarding

This acceptance covers installation, authentication and a real full backup. Restore remains open until its own executed test has passed.

• File Daemon and Director use unique matching resource names.
• The client secret is absent from the article and repository and matches on both sides.
• The File Daemon binds to 192.168.77.11:9102.
• bareos-fd -t and bareos-dir -t pass without errors or deprecated warnings.
• status client confirms Immediate TLS and TLS 1.3.
• estimate confirms five entries and 135 bytes in the test FileSet.
• Full job 2 finishes with Success/T, zero errors and volume Full-0001.
• Real desktop and mobile WebUI views passed Playwright without console errors.
• Still open and not claimed: restore, production schedule, retention, offsite and disaster recovery.