+After creating a datastore, the following default layout will appear:
+
+.. code-block:: console
+
+ # ls -arilh /backup/disk1/store1
+ 276493 -rw-r--r-- 1 backup backup 0 Jul 8 12:35 .lock
+ 276490 drwxr-x--- 1 backup backup 1064960 Jul 8 12:35 .chunks
+
+`.lock` is an empty file used for process locking.
+
+The `.chunks` directory contains folders, starting from `0000` and taking hexadecimal values until `ffff`. These
+directories will store the chunked data after a backup operation has been executed.
+
+.. code-block:: console
+
+ # ls -arilh /backup/disk1/store1/.chunks
+ 545824 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 ffff
+ 545823 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fffe
+ 415621 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fffd
+ 415620 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fffc
+ 353187 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fffb
+ 344995 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fffa
+ 144079 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fff9
+ 144078 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fff8
+ 144077 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 fff7
+ ...
+ 403180 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 000c
+ 403179 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 000b
+ 403177 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 000a
+ 402530 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0009
+ 402513 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0008
+ 402509 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0007
+ 276509 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0006
+ 276508 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0005
+ 276507 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0004
+ 276501 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0003
+ 276499 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0002
+ 276498 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0001
+ 276494 drwxr-x--- 2 backup backup 4.0K Jul 8 12:35 0000
+ 276489 drwxr-xr-x 3 backup backup 4.0K Jul 8 12:35 ..
+ 276490 drwxr-x--- 1 backup backup 1.1M Jul 8 12:35 .
+
+
+
+User Management
+~~~~~~~~~~~~~~~
+
+Proxmox Backup Server supports several authentication realms, and you need to
+choose the realm when you add a new user. Possible realms are:
+
+:pam: Linux PAM standard authentication. Use this if you want to
+ authenticate as Linux system user (Users need to exist on the
+ system).
+
+:pbs: Proxmox Backup Server realm. This type stores hashed passwords in
+ ``/etc/proxmox-backup/shadow.json``.
+
+After installation, there is a single user ``root@pam``, which
+corresponds to the Unix superuser. You can use the
+``proxmox-backup-manager`` command line tool to list or manipulate
+users:
+
+.. code-block:: console
+
+ # proxmox-backup-manager user list
+ ┌─────────────┬────────┬────────┬───────────┬──────────┬────────────────┬────────────────────┐
+ │ userid │ enable │ expire │ firstname │ lastname │ email │ comment │
+ ╞═════════════╪════════╪════════╪═══════════╪══════════╪════════════════╪════════════════════╡
+ │ root@pam │ 1 │ │ │ │ │ Superuser │
+ └─────────────┴────────┴────────┴───────────┴──────────┴────────────────┴────────────────────┘
+
+The superuser has full administration rights on everything, so you
+normally want to add other users with less privileges:
+
+.. code-block:: console
+
+ # proxmox-backup-manager user create john@pbs --email john@example.com
+
+The create command lets you specify many options like ``--email`` or
+``--password``. You can update or change any of them using the
+update command later:
+
+.. code-block:: console
+
+ # proxmox-backup-manager user update john@pbs --firstname John --lastname Smith
+ # proxmox-backup-manager user update john@pbs --comment "An example user."
+
+.. todo:: Mention how to set password without passing plaintext password as cli argument.
+
+
+The resulting user list looks like this:
+
+.. code-block:: console
+
+ # proxmox-backup-manager user list
+ ┌──────────┬────────┬────────┬───────────┬──────────┬──────────────────┬──────────────────┐
+ │ userid │ enable │ expire │ firstname │ lastname │ email │ comment │
+ ╞══════════╪════════╪════════╪═══════════╪══════════╪══════════════════╪══════════════════╡
+ │ john@pbs │ 1 │ │ John │ Smith │ john@example.com │ An example user. │
+ ├──────────┼────────┼────────┼───────────┼──────────┼──────────────────┼──────────────────┤
+ │ root@pam │ 1 │ │ │ │ │ Superuser │
+ └──────────┴────────┴────────┴───────────┴──────────┴──────────────────┴──────────────────┘
+
+Newly created users do not have any permissions. Please read the next
+section to learn how to set access permissions.
+
+If you want to disable a user account, you can do that by setting ``--enable`` to ``0``
+
+.. code-block:: console
+
+ # proxmox-backup-manager user update john@pbs --enable 0
+
+Or completely remove the user with:
+
+.. code-block:: console
+
+ # proxmox-backup-manager user remove john@pbs
+
+
+Access Control
+~~~~~~~~~~~~~~
+
+By default new users do not have any permission. Instead you need to
+specify what is allowed and what is not. You can do this by assigning
+roles to users on specific objects like datastores or remotes. The
+following roles exist:
+
+**NoAccess**
+ Disable Access - nothing is allowed.
+
+**Admin**
+ The Administrator can do anything.
+
+**Audit**
+ An Auditor can view things, but is not allowed to change settings.
+
+**DatastoreAdmin**
+ Can do anything on datastores.
+
+**DatastoreAudit**
+ Can view datastore settings and list content. But
+ is not allowed to read the actual data.
+
+**DataStoreReader**
+ Can Inspect datastore content and can do restores.
+
+**DataStoreBackup**
+ Can backup and restore owned backups.
+
+**DatastorePowerUser**
+ Can backup, restore, and prune owned backups.
+
+**RemoteAdmin**
+ Can do anything on remotes.
+
+**RemoteAudit**
+ Can view remote settings.
+
+**RemoteSyncOperator**
+ Is allowed to read data from a remote.
+
+
+:term:`Remote`
+~~~~~~~~~~~~~~
+
+A remote is a different Proxmox Backup Server installation and a user on that
+installation, from which you can `sync` datastores to a local datastore with a
+`Sync Job`.
+
+For adding a remote you need its hostname or ip, a userid and password on the
+remote and its certificate fingerprint to add it. To get the fingerprint use
+the ``proxmox-backup-manager cert info`` command on the remote.
+
+.. code-block:: console
+
+ # proxmox-backup-manager cert info |grep Fingerprint
+ Fingerprint (sha256): 64:d3:ff:3a:50:38:53:5a:9b:f7:50:...:ab:fe
+
+With the needed information add the remote with:
+
+.. code-block:: console
+
+ # proxmox-backup-manager remote create pbs2 --host pbs2.mydomain.example --userid sync@pam --password 'SECRET' --fingerprint 64:d3:ff:3a:50:38:53:5a:9b:f7:50:...:ab:fe
+
+Use the ``list``, ``show``, ``update``, ``remove`` subcommands of
+``proxmox-backup-manager remote`` to manage your remotes:
+
+.. code-block:: console
+
+ # proxmox-backup-manager remote update pbs2 --host pbs2.example
+ # proxmox-backup-manager remote list
+ ┌──────┬──────────────┬──────────┬───────────────────────────────────────────┬─────────┐
+ │ name │ host │ userid │ fingerprint │ comment │
+ ╞══════╪══════════════╪══════════╪═══════════════════════════════════════════╪═════════╡
+ │ pbs2 │ pbs2.example │ sync@pam │64:d3:ff:3a:50:38:53:5a:9b:f7:50:...:ab:fe │ │
+ └──────┴──────────────┴──────────┴───────────────────────────────────────────┴─────────┘
+ # proxmox-backup-manager remote remove pbs2
+
+
+Sync Jobs
+~~~~~~~~~
+
+Sync jobs are configured to pull the contents of a datastore on a `Remote` to a
+local datastore. You can either start the sync job manually on the GUI or
+provide it with a :term:`schedule` to run regularly. The
+``proxmox-backup-manager sync-job`` command is used to manage sync jobs:
+
+.. code-block:: console
+
+ # proxmox-backup-manager sync-job create pbs2-local --remote pbs2 --remote-store local --store local --schedule 'Wed 02:30'
+ # proxmox-backup-manager sync-job update pbs2-local --comment 'offsite'
+ # proxmox-backup-manager sync-job list
+ ┌────────────┬───────┬────────┬──────────────┬───────────┬─────────┐
+ │ id │ store │ remote │ remote-store │ schedule │ comment │
+ ╞════════════╪═══════╪════════╪══════════════╪═══════════╪═════════╡
+ │ pbs2-local │ local │ pbs2 │ local │ Wed 02:30 │ offsite │
+ └────────────┴───────┴────────┴──────────────┴───────────┴─────────┘
+ # proxmox-backup-manager sync-job remove pbs2-local