Skip to content
Rowsafe
Start free
Docs

Set up backup storage

Create a bucket and access key for your backups, on R2, B2, S3, Wasabi, Spaces or any S3-compatible storage.

Don't want to set up a bucket?

Use Rowsafe Storage: nothing to set up, still encrypted on your server. Or follow this page: about 10 minutes, and Cloudflare R2's first 10 GB are free. Prefer a server of your own, like a Hetzner Storage Box? See Backups to your own server (SFTP) (PostgreSQL).

Your backups live in a bucket you own. Rowsafe never stores your data and never sees the bucket's keys: they stay on your server.

You need:

  1. The bucket URL of an empty, private bucket just for Rowsafe.
  2. An access key (ID and secret) that can read, write and delete in it.
  3. An encryption passphrase. The installer makes one.

The installer asks for the bucket URL first, works out the provider, region and name from it, then asks for the key. It tests the bucket before it finishes. You never paste keys into the dashboard.

Which provider should I pick?

No preference? Cloudflare R2: the first 10 GB are free and downloads (restores) cost nothing. Every provider below works the same way.

Cloudflare R2

Create a bucket

In the Cloudflare dashboard, open R2 Object Storage, then Create bucket (for example mycompany-rowsafe). For EU data, set the location to European Union (EU jurisdiction). Leave public access off.

Copy the bucket URL

In the bucket's Settings, copy the S3 API URL:

https://<account-id>.r2.cloudflarestorage.com/mycompany-rowsafe

An EU bucket has .eu in it: https://<account-id>.eu.r2.cloudflarestorage.com/mycompany-rowsafe.

Create an access key

In R2, Manage API tokens, then Create API token. Pick Object Read & Write, limited to your new bucket. Copy the Access Key ID and Secret Access Key: they're shown once.

Backblaze B2

Create a bucket

In your Backblaze account, Create a Bucket. Make it Private.

Copy the bucket URL

The bucket's Endpoint (like s3.us-west-004.backblazeb2.com), then the bucket name:

https://s3.us-west-004.backblazeb2.com/mycompany-rowsafe

Create an application key

Application Keys, then Add a New Application Key: your new bucket only, Read and Write. Copy the keyID (access key ID) and applicationKey (secret). It's shown once.

Amazon S3

Create a bucket

In the S3 console, Create bucket in a region near your server. Keep Block all public access on.

Copy the bucket URL

Either form works:

https://mycompany-rowsafe.s3.eu-central-1.amazonaws.com
https://s3.eu-central-1.amazonaws.com/mycompany-rowsafe

Create an access key for Rowsafe only

In IAM, create a user for Rowsafe (no console access) with a policy for this bucket only:

{
  "Version": "2012-10-17",
  "Statement": [
    { "Effect": "Allow", "Action": "s3:ListBucket", "Resource": "arn:aws:s3:::YOUR-BUCKET" },
    { "Effect": "Allow", "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject"], "Resource": "arn:aws:s3:::YOUR-BUCKET/*" }
  ]
}

Create an access key for that user and copy the ID and secret.

Wasabi

Create a bucket

In the Wasabi console, Create Bucket in a region. Keep it private.

Copy the bucket URL

The region's endpoint, then the bucket name:

https://s3.eu-central-1.wasabisys.com/mycompany-rowsafe

Create an access key

Create a sub-user with programmatic access and a policy for this bucket only (read, write, delete). Create an access key and copy the key and secret.

DigitalOcean Spaces

Create a Space

In the DigitalOcean control panel, Create a Spaces Bucket in a region (like fra1). Keep file listing restricted.

Copy the bucket URL

Copy the Space's Origin Endpoint:

https://mycompany-rowsafe.fra1.digitaloceanspaces.com

Create an access key

Spaces Object Storage > Access Keys: create a key with read, write and delete, limited to this bucket if you can. Copy the key and secret.

Other S3-compatible storage

Any S3 storage over HTTPS works: MinIO, Ceph, Hetzner, OVHcloud, Scaleway and others. Create a private bucket and a key limited to it.

The bucket URL is the endpoint, then the bucket name: https://s3.example.com/mycompany-rowsafe or https://s3.example.com:9000/mycompany-rowsafe.

The encryption passphrase

Backups are encrypted on your server before upload, so your provider only sees scrambled data. The installer makes a strong passphrase and shows it once.

Save the passphrase in your password manager

Without it, your backups can't be restored. Rowsafe has no copy. The installer asks for its last 4 characters to confirm you saved it.

Without questions

For automation, set ROWSAFE_REPO_S3_ENDPOINT, ROWSAFE_REPO_S3_BUCKET, ROWSAFE_REPO_S3_KEY, ROWSAFE_REPO_S3_KEY_SECRET and ROWSAFE_REPO_CIPHER_PASS in the installer's environment. It then asks nothing about storage. Example: Adopt an existing database. Every setting: Agent configuration.

Good to know

  • Use a dedicated, empty, private bucket. Rowsafe never needs public access.

  • No lifecycle or auto-delete rules. Rowsafe removes old backups itself; a rule could delete files newer backups depend on.

  • Test the settings again on the server:

    curl -fsSL https://rowsafe.sh | sudo sh -s -- --check-storage

  • Change storage later with --setup-storage. Keep your existing passphrase when it offers: earlier backups need it.

Edit on GitHub

Rowsafe on your server

Install Rowsafe on your database server and use it from there, with no account. Continuous backups to your own storage, Marks, a weekly restore test, restore to any second, alerts, Pulse with history, upgrades and more, with sudo rowsafe.

Rowsafe Storage

Keep backups without a bucket of your own, encrypted so Rowsafe can't read them.

On this page

Cloudflare R2Create a bucketCopy the bucket URLCreate an access keyBackblaze B2Create a bucketCopy the bucket URLCreate an application keyAmazon S3Create a bucketCopy the bucket URLCreate an access key for Rowsafe onlyWasabiCreate a bucketCopy the bucket URLCreate an access keyDigitalOcean SpacesCreate a SpaceCopy the bucket URLCreate an access keyOther S3-compatible storageThe encryption passphraseWithout questionsGood to know