[{"data":1,"prerenderedAt":10},["ShallowReactive",2],{"public:public\u002Fcontent\u002Fdocs\u002Fovhcloud":3},{"slug":4,"title":5,"description":6,"draft":7,"updated":8,"html":9},"ovhcloud","OVHcloud Object Storage","Write pg_dump backups to OVHcloud S3-compatible Object Storage and give Verestore an S3 user with a read-only policy.",false,null,"\u003Ch1>OVHcloud Object Storage (S3-compatible)\u003C\u002Fh1>\n\u003Cblockquote>\n\u003Cp>Verified against the provider's documentation, not against a live account.\u003C\u002Fp>\n\u003C\u002Fblockquote>\n\u003Cp>Managed database backups stay inside OVHcloud's service and disappear with the project; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.\u003C\u002Fp>\n\u003Ch2>1. Write dumps to Object Storage\u003C\u002Fh2>\n\u003Cp>The S3 endpoint is \u003Ccode>https:\u002F\u002Fs3.<region>.io.cloud.ovh.net\u003C\u002Fcode>, for example \u003Ccode>https:\u002F\u002Fs3.gra.io.cloud.ovh.net\u003C\u002Fcode> (also \u003Ccode>de\u003C\u002Fcode>, \u003Ccode>sbg\u003C\u002Fcode> and others). The bucket's details in the Control Panel show yours. With separate read-write credentials for your backup job:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-sh\">pg_dump --format=custom --no-owner "$DATABASE_URL" \\\n  | aws --endpoint-url https:\u002F\u002Fs3.gra.io.cloud.ovh.net --region gra \\\n      s3 cp - "s3:\u002F\u002Facme-backups\u002Forders\u002Forders-$(date -u +%Y-%m-%dT%H-%M).dump"\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>If a recent AWS CLI rejects the upload with a checksum or header error, set \u003Ccode>AWS_REQUEST_CHECKSUM_CALCULATION=when_required\u003C\u002Fcode> for the backup job.\u003C\u002Fp>\n\u003Cp>Verestore accepts \u003Ccode>pg_dump\u003C\u002Fcode> custom format (\u003Ccode>-Fc\u003C\u002Fcode>) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.\u003C\u002Fp>\n\u003Ch2>2. Create an S3 user for Verestore\u003C\u002Fh2>\n\u003Col>\n\u003Cli>In your Public Cloud project, open \u003Cstrong>Users & Roles\u003C\u002Fstrong> and create a user, for example \u003Ccode>verestore-reader\u003C\u002Fcode>.\u003C\u002Fli>\n\u003Cli>Generate \u003Cstrong>S3 credentials\u003C\u002Fstrong> for that user. The access key and secret key are what you give Verestore.\u003C\u002Fli>\n\u003C\u002Fol>\n\u003Cp>Check the provider's current documentation for the role the user needs to hold S3 credentials; give it no other access.\u003C\u002Fp>\n\u003Ch2>3. Attach a read-only S3 user policy\u003C\u002Fh2>\n\u003Cp>OVHcloud lets you import a JSON policy for an S3 user. Use:\u003C\u002Fp>\n\u003Cpre>\u003Ccode class=\"language-json\">{\n  "Version": "2012-10-17",\n  "Statement": [\n    {\n      "Sid": "ListOnlyThePrefix",\n      "Effect": "Allow",\n      "Action": ["s3:ListBucket"],\n      "Resource": ["arn:aws:s3:::acme-backups"],\n      "Condition": { "StringLike": { "s3:prefix": ["orders\u002F*"] } }\n    },\n    {\n      "Sid": "ReadOnlyThePrefix",\n      "Effect": "Allow",\n      "Action": ["s3:GetObject"],\n      "Resource": ["arn:aws:s3:::acme-backups\u002Forders\u002F*"]\n    }\n  ]\n}\n\u003C\u002Fcode>\u003C\u002Fpre>\n\u003Cp>Which condition keys OVHcloud evaluates may differ from AWS: check the provider's current documentation. If the \u003Ccode>s3:prefix\u003C\u002Fcode> condition is not supported, remove the \u003Ccode>Condition\u003C\u002Fcode> block and use a \u003Cstrong>dedicated bucket per database\u003C\u002Fstrong>, so listing the bucket reveals nothing else.\u003C\u002Fp>\n\u003Cp>Verestore only lists objects under the prefix (\u003Ccode>ListObjectsV2\u003C\u002Fcode>) and reads \u003Ccode>orders\u002F*\u003C\u002Fcode>, pinned to the listed ETag. It never writes or deletes.\u003C\u002Fp>\n\u003Ch2>4. Add the target in Verestore\u003C\u002Fh2>\n\u003Cul>\n\u003Cli>S3 endpoint: \u003Ccode>https:\u002F\u002Fs3.gra.io.cloud.ovh.net\u003C\u002Fcode> (your bucket's region)\u003C\u002Fli>\n\u003Cli>Region: \u003Ccode>gra\u003C\u002Fcode> (or leave it empty: it is filled from the endpoint)\u003C\u002Fli>\n\u003Cli>Bucket: \u003Ccode>acme-backups\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Prefix: \u003Ccode>orders\u002F\u003C\u002Fcode>\u003C\u002Fli>\n\u003Cli>Access key ID and secret access key: the S3 credentials from step 2\u003C\u002Fli>\n\u003C\u002Ful>\n",1794290783590]