Skip to content
Rowsafe
Docs

Set up backup storage

Create a storage bucket and an access key for your backups, with step-by-step instructions for Cloudflare R2, Backblaze B2, Amazon S3, Wasabi, DigitalOcean Spaces and other S3-compatible storage.

Rowsafe keeps your backups in a storage bucket that you own. Rowsafe never stores your data itself, and it never sees the keys to your bucket: they stay on your database server.

You need three things:

  1. An empty, private bucket just for Rowsafe.
  2. An access key (an ID and a secret) that can read, write and delete files in that bucket.
  3. An encryption passphrase. The installer can generate one for you.

The agent installer asks for these in your terminal and tests the bucket before it finishes, so you'll know right away if anything is wrong. You never paste keys into the Rowsafe dashboard.

Which provider should I pick?

If you don't have a preference, use Cloudflare R2: the first 10 GB are free and downloads (restores) cost nothing. Any provider below works the same way with Rowsafe.

Cloudflare R2

Create a bucket

In the Cloudflare dashboard, open R2 Object Storage and choose Create bucket. Give it a name such as mycompany-rowsafe. If your data must stay in the EU, set the location to European Union (EU jurisdiction). Leave public access off.

Create an access key

Still in R2, open Manage API tokens and choose Create API token. Pick Object Read & Write, and under "Specify bucket(s)" select only your new bucket. After you create it, keep the page open: it shows the Access Key ID, the Secret Access Key (only once) and your account ID.

Run the installer

When the installer asks where to store backups, choose Cloudflare R2 and paste the account ID, bucket name, access key ID and secret. Answer "yes" to the EU question if you created the bucket with the EU location.

Backblaze B2

Create a bucket

In your Backblaze account, choose Create a Bucket. Make it Private. Note the Endpoint shown on the bucket, for example s3.us-west-004.backblazeb2.com: the part after s3. and before .backblazeb2.com is your region (us-west-004).

Create an application key

Open Application Keys and choose Add a New Application Key. Allow access to your new bucket only, with Read and Write access. Copy the keyID and the applicationKey; the application key is shown only once.

Run the installer

Choose Backblaze B2 and enter the region, bucket name, keyID (as the access key ID) and applicationKey (as the secret).

Amazon S3

Create a bucket

In the S3 console, choose Create bucket, pick a region close to your database server, and keep Block all public access turned on.

Create an access key for Rowsafe only

In IAM, create a user for Rowsafe (no console access) and attach a policy that allows only this bucket:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::YOUR-BUCKET" },
    { "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"], "Resource": "arn:aws:s3:::YOUR-BUCKET/*" }
  ]
}

Then create an access key for that user and copy the access key ID and secret.

Run the installer

Choose Amazon S3 and enter the bucket's region (for example eu-central-1), the bucket name, and the key.

Wasabi

Create a bucket

In the Wasabi console, choose Create Bucket and pick a region. Keep it private.

Create an access key

Create a sub-user for Rowsafe with programmatic access, give it a policy limited to this bucket (read, write, delete), and create an access key for it. Copy the key and secret.

Run the installer

Choose Wasabi and enter the bucket's region (for example eu-central-1), the bucket name, and the key.

DigitalOcean Spaces

Create a Space

In the DigitalOcean control panel, choose Create a Spaces Bucket, pick a datacenter region (for example fra1) and keep file listing restricted.

Create an access key

Open Spaces Object Storage > Access Keys and create a key with read, write and delete access, limited to this bucket if you can. Copy the access key and secret.

Run the installer

Choose DigitalOcean Spaces and enter the region slug (for example fra1), the bucket name, and the key.

Other S3-compatible storage

Rowsafe works with any storage that speaks the S3 protocol over HTTPS: MinIO, Ceph, Hetzner Object Storage, OVHcloud Object Storage, Scaleway and others. Create a private bucket and an access key limited to it, then choose Other S3-compatible storage in the installer and enter the endpoint (for example s3.example.com or s3.example.com:9000), bucket name and key.

The encryption passphrase

Backups are encrypted on your server before they're uploaded, so your storage provider only ever sees scrambled data. The installer offers to generate a strong passphrase and shows it once.

Save the passphrase in your password manager

Without it, your backups can't be restored. Rowsafe doesn't have a copy and can't recover it. The installer asks you to type its last 4 characters to confirm you've saved it.

Good to know

  • Use a dedicated, empty bucket for Rowsafe. Don't share it with other files.

  • Don't add lifecycle or auto-delete rules to the bucket. Rowsafe removes old backups itself, and a lifecycle rule could delete files that newer backups still depend on.

  • Keep the bucket private. Rowsafe never needs public access.

  • Test your settings again at any time on the server:

    curl -fsSL https://rowsafe.sh | sudo sh -s -- --check-storage
  • Change storage later with --setup-storage. The installer offers to keep your existing passphrase, which your earlier backups still need.

Edit on GitHub