[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Fbackblaze-b2":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"backblaze-b2","Backblaze B2","Write pg_dump backups to a B2 bucket and give Verestore an application key limited to one bucket, one prefix, list and read.",false,null,"\u003Ch1>Backblaze B2\u003C\u002Fh1>\n\u003Cblockquote>\n\u003Cp>Verified against the provider's documentation, not against a live account.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>A provider snapshot disappears with the account that holds it; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.\u003C\u002Fp>\n\u003Ch2>1. Write dumps to B2\u003C\u002Fh2>\n\u003Cp>B2's S3-compatible endpoint is \u003Ccode>https:\u002F\u002Fs3.<region>.backblazeb2.com\u003C\u002Fcode>, for example \u003Ccode>https:\u002F\u002Fs3.us-west-004.backblazeb2.com\u003C\u002Fcode>. The bucket details in the B2 web UI show yours. With a separate read-write key for your backup job:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-sh\">pg_dump --format=custom --no-owner "$DATABASE_URL" \\\n  | aws --endpoint-url https:\u002F\u002Fs3.us-west-004.backblazeb2.com --region us-west-004 \\\n      s3 cp - "s3:\u002F\u002Facme-backups\u002Forders\u002Forders-$(date -u +%Y-%m-%dT%H-%M).dump"\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>If a recent AWS CLI rejects the upload with a checksum or header error, set \u003Ccode>AWS_REQUEST_CHECKSUM_CALCULATION=when_required\u003C\u002Fcode> for the backup job.\u003C\u002Fp>\n\u003Cp>Verestore accepts \u003Ccode>pg_dump\u003C\u002Fcode> custom format (\u003Ccode>-Fc\u003C\u002Fcode>) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.\u003C\u002Fp>\n\u003Ch2>2. Create a restricted application key\u003C\u002Fh2>\n\u003Cp>An application key can be limited to one bucket and a file name prefix. Give it only \u003Ccode>listFiles\u003C\u002Fcode> and \u003Ccode>readFiles\u003C\u002Fcode>:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-sh\">b2 key create --bucket acme-backups --name-prefix orders\u002F verestore-reader listFiles,readFiles\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>This is the syntax of the current \u003Ccode>b2\u003C\u002Fcode> CLI; older versions use \u003Ccode>b2 create-key\u003C\u002Fcode> with the same options. Check \u003Ccode>b2 key create --help\u003C\u002Fcode> for your version. You can also create the key in the B2 web UI with the same bucket, prefix and read-only access.\u003C\u002Fp>\n\u003Cp>The output contains the \u003Cstrong>keyID\u003C\u002Fstrong> (the access key ID) and the \u003Cstrong>applicationKey\u003C\u002Fstrong> (the secret access key). The application key is shown once.\u003C\u002Fp>\n\u003Cp>Verestore only lists objects under the prefix (\u003Ccode>ListObjectsV2\u003C\u002Fcode>) and reads \u003Ccode>orders\u002F*\u003C\u002Fcode>, pinned to the listed ETag. It never writes or deletes.\u003C\u002Fp>\n\u003Ch2>3. Add the target in Verestore\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>S3 endpoint: \u003Ccode>https:\u002F\u002Fs3.us-west-004.backblazeb2.com\u003C\u002Fcode> (your bucket's region)\u003C\u002Fli>\n\u003Cli>Region: \u003Ccode>us-west-004\u003C\u002Fcode> (or leave it empty: it is filled from the endpoint)\u003C\u002Fli>\n\u003Cli>Bucket: \u003Ccode>acme-backups\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Prefix: \u003Ccode>orders\u002F\u003C\u002Fcode> (the same as the key's name prefix)\u003C\u002Fli>\n\u003Cli>Access key ID: the keyID; secret access key: the applicationKey\u003C\u002Fli>\n\u003C\u002Ful>\n",1794290783588]