Set up MomentBackup Hub.

Hub is optional. It runs on your NAS or home server and gives you one place to see whether every computer is backing up.

1. Choose how Hub is reached

Pick one before first start:

• Built-in certificate: set MBHUB_TLS to self-signed and give Hub a stable MBHUB_PUBLIC_URL.
• Your reverse proxy: set MBHUB_TRUST_PROXY to 1, remove MBHUB_TLS, and delete the ports: block below so only the proxy can reach Hub. Leaving port 8675 published while the proxy terminates TLS puts each computer's command token on your network in the clear.
• Trusted LAN only: remove MBHUB_TLS, set MBHUB_INSECURE to 1, and change MBHUB_PUBLIC_URL to its http:// address. Sign-in passwords, session cookies, and each computer's long-lived command token then cross your network in the clear on every poll, so only use this on a network you fully trust.

2. Start the container

Save this as docker-compose.yml. Replace 192.168.1.50 with the stable address your computers use to reach this server. An IP address is the safest choice: Hub checks its own health by connecting to this address from inside the container, so a name that does not resolve there reports the container as unhealthy while Hub is in fact serving normally.

services:
  momentbackup-hub:
    image: ghcr.io/momentbackup/momentbackup-hub:1.0
    container_name: momentbackup-hub
    restart: unless-stopped
    init: true
    user: "10001:10001"
    ports:
      - "8675:8675"
    volumes:
      - hub-data:/data
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
    environment:
      MBHUB_TLS: "self-signed"
      MBHUB_PUBLIC_URL: "https://192.168.1.50:8675"
      MBHUB_SCAN_PATHS: ""
      MBHUB_HEARTBEAT: "on"
      TZ: "Australia/Sydney"
    logging:
      driver: json-file
      options:
        max-size: "10m"
        max-file: "3"

volumes:
  hub-data:

Set TZ to your own time zone — without it every time Hub shows reads as UTC. The logging block keeps the container's log from growing without a limit on a server meant to run for years.

docker compose up -d

3. Create the owner account

Open the address from MBHUB_PUBLIC_URL. Hub is serving a certificate it made itself, so your browser warns that the connection is not private the first time. That is expected here — the computers you connect pin this Hub's exact certificate and refuse anything else, which is a narrower rule than a public certificate gives you. Continue, then create the owner account.

Do this now, before anyone else can reach the address. Until the account exists, Hub has no owner, and whoever reaches it first becomes that owner. If you would rather prove machine access instead, set MBHUB_SECURE_SETUP to on before the first start and read the setup link with docker compose exec momentbackup-hub cat /data/setup-url.

Hub keeps its data in the hub-data volume, so include that volume in your normal server backup.

4. Connect a computer

This needs MomentBackup 1.0.13 or later on that computer.

1. In Hub, open Connect computers and find Let this Hub see a computer.
2. Reveal the report-only link. Hub shows it once, so open it on that computer and save it before you leave the page.
3. When the computer appears in Hub, use Let this Hub send it commands to create its one-time pairing link.
4. Open the pairing link and review the connection in MomentBackup, under Settings → Hub. Nothing is applied until you accept it there.

Immutable Hub 1.0.5 image:
ghcr.io/momentbackup/momentbackup-hub@sha256:c833bd0916e64933c59c73d3494bcc096820cef611ef46bfbbacae0b5d617c31

Verify those exact bytes were built by this project before you run them:

cosign verify \
  --certificate-oidc-issuer https://token.actions.githubusercontent.com \
  --certificate-identity https://github.com/MomentBackup/momentbackup-hub/.github/workflows/hub-image.yml@refs/tags/hub-v1.0.5 \
  ghcr.io/momentbackup/momentbackup-hub@sha256:c833bd0916e64933c59c73d3494bcc096820cef611ef46bfbbacae0b5d617c31