[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Fdigitalocean-spaces":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"digitalocean-spaces","DigitalOcean Spaces","Write pg_dump backups to a Space and give Verestore a limited-access Spaces key with read permission on that bucket only.",false,null,"\u003Ch1>DigitalOcean Spaces\u003C\u002Fh1>\n\u003Cblockquote>\n\u003Cp>Verified against the provider's documentation, not against a live account.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Managed Database backups stay inside DigitalOcean's service and disappear with the account; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.\u003C\u002Fp>\n\u003Ch2>1. Write dumps to Spaces\u003C\u002Fh2>\n\u003Cp>The endpoint is \u003Ccode>https:\u002F\u002F<region>.digitaloceanspaces.com\u003C\u002Fcode>, for example \u003Ccode>https:\u002F\u002Fams3.digitaloceanspaces.com\u003C\u002Fcode>. With a separate read-write Spaces key for your backup job:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-sh\">pg_dump --format=custom --no-owner "$DATABASE_URL" \\\n  | aws --endpoint-url https:\u002F\u002Fams3.digitaloceanspaces.com --region ams3 \\\n      s3 cp - "s3:\u002F\u002Facme-backups\u002Forders\u002Forders-$(date -u +%Y-%m-%dT%H-%M).dump"\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>If a recent AWS CLI rejects the upload with a checksum or header error, set \u003Ccode>AWS_REQUEST_CHECKSUM_CALCULATION=when_required\u003C\u002Fcode> for the backup job.\u003C\u002Fp>\n\u003Cp>Verestore accepts \u003Ccode>pg_dump\u003C\u002Fcode> custom format (\u003Ccode>-Fc\u003C\u002Fcode>) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.\u003C\u002Fp>\n\u003Ch2>2. Create a limited-access Spaces key\u003C\u002Fh2>\n\u003Cp>Spaces keys can be limited per bucket, not per prefix. Use a \u003Cstrong>dedicated bucket per database\u003C\u002Fstrong> so the key can read nothing else.\u003C\u002Fp>\n\u003Col>\n\u003Cli>In the DigitalOcean control panel, create a \u003Cstrong>Spaces access key\u003C\u002Fstrong> named \u003Ccode>verestore-reader\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>Choose \u003Cstrong>Limited access\u003C\u002Fstrong>.\u003C\u002Fli>\n\u003Cli>Add the bucket \u003Ccode>acme-backups\u003C\u002Fcode> with the \u003Cstrong>Read\u003C\u002Fstrong> permission, and no other bucket.\u003C\u002Fli>\n\u003Cli>Copy the access key ID and secret key. The secret is shown once.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Verestore only lists objects under the prefix (\u003Ccode>ListObjectsV2\u003C\u002Fcode>) and reads \u003Ccode>orders\u002F*\u003C\u002Fcode>, pinned to the listed ETag. It never writes or deletes.\u003C\u002Fp>\n\u003Ch2>3. Add the target in Verestore\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>S3 endpoint: \u003Ccode>https:\u002F\u002Fams3.digitaloceanspaces.com\u003C\u002Fcode> (your bucket's region)\u003C\u002Fli>\n\u003Cli>Region: \u003Ccode>ams3\u003C\u002Fcode> (or leave it empty: it is filled from the endpoint)\u003C\u002Fli>\n\u003Cli>Bucket: \u003Ccode>acme-backups\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Prefix: \u003Ccode>orders\u002F\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Access key ID and secret access key: from the limited-access key\u003C\u002Fli>\n\u003C\u002Ful>\n",1794290783589]