Sorry for the delay -- it took a while to dig up the references.
The strong recommendation to build into a single directory is in the version 5.0.1 release notes (which were included with the all the 5.x series release notes including the last release at the time of writing, 5.2.13). References:
http://www.bacula.org/git/cgit.cgi/b...Release-5.2.13 and
http://sourceforge.net/p/bacula/mail...ewmonth=201002. Extract:
Code:
5. The Bacula project strongly recommends that you install Bacula into a
single directory, with a few minor exceptions such as the MySQL or
PostgreSQL databases. Preferrably this should be /opt/bacula.
...
Obviously, the email, and some of the minor options (mysql, postgresql,
...) can be changed to suit your distribution, but the directory names
defined above are strongly recommended, and over time the default values in
the bacula-dir.conf and bacula-sd.conf will reflect these choices.
If you have any questions about this or would like a detailed document
describing our recommendations including packaging requirements, please
send an email to the bacula-devel list.
I asked about this recommendation on the bacula-devel mailing list and got two replies including one from Ken Sibbald who leads the bacula project:
https://www.mail-archive.com/bacula-.../msg06093.html and
https://www.mail-archive.com/bacula-.../msg06094.html
Given that it is such a strong recommendation, it is strange that it is not in the main 5.x documentation and not in the release notes for the recent 7.x releases (I have not read the main 7.x documentation). Perhaps the bacula project takes the view that only packagers need this information and they are capable of finding it in old release notes ... ?
If you want to put your backups on a different HDD from the OS, there is nothing about installing to /opt/bacula to prevent that. /opt/bacula could be a mount point for a file system on a different HDD from the OS.
Regards ownerships and permissions, you can set it up so only root has access. Strictly speaking only the bacula-fd process needs to be run with root privileges but it's simple to use root for all the bacula daemons.