Connect a storage

A storage is an S3 bucket at any provider: Hetzner, Scaleway, Wasabi, AWS, MinIO and others. Each server's backups are kept there in its own encrypted restic repository. Connect a storage before the first server: without it the protection plan can't be saved.

What to prepare

Create a bucket and an access key for it at the provider in advance.

arcula writes only to arcula/ inside the prefix and to the test .arcula-check/. Everything else in the bucket is “not ours”: arcula doesn't write, change or delete it.

Connect

1. Panel → “Storages” → “+ Storage”.
2. Fill in the fields and choose whose key it is — how to choose is below.
3. Click “Check”. The panel checks access in the test prefix .arcula-check/: list, write, read, deleting its own test object, multipart upload. It doesn't touch other data.
4. Look at “What S3 answered” — the provider's answer to each check, as is. Without list, read and write the “Connect” button stays disabled: check the key, the bucket and the permissions.
5. Look at “What is already in the bucket”. The panel shows other files and restic repositories with their size — arcula won't touch them. If there is an arcula/ directory of another panel, take a different prefix, unless it's your previous panel.
6. Click “Connect”.

If you changed the address or the key after the check, click “Check again”: the check applies to what is in the form now.

The secret key is stored encrypted and is never shown in the panel again. From then on the panel checks the storage itself: access — every 6 hours, space — every 45 minutes, part of the data — every night.

One key or each server its own

The “Whose key” field:

• “One for all servers” — all servers write with one key. Simple, but a compromised server can delete the backups of all servers in this storage.
• “Each server has its own” — each server has a key only for its folder arcula/<server id>/. A compromised server can delete only its own backups. You need a provider that issues keys per prefix.

arcula has no deletion protection: the agent writes to S3 directly. The panel states this plainly on the storage: “Deletion protection — none”.

With “own key”, the key from the form stays with the panel — for checks and measuring space. Server keys are set after connecting:

1. Add the storage to the server's protection plan.
2. Storage → the “Connection” tab → the “Server keys” card.
3. For the server, click “Set key”, enter a key for its folder and click “Check and save”. The panel checks the key in the server's folder before saving.

Until there is a key, this server's backups don't go here, and the server shows a warning. You can change the mode later: “Connection” → “Change mode”.

Limit

The limit is how much space you're ready to give to backups. From it the panel calculates how many days the space will last at the average growth. Backups don't stop at the limit: it's a forecast, not a ban.

By default the limit counts only arcula's data. If the bucket has data that isn't ours, you can tick “count the limit over the whole bucket”. To set or change the limit later: storage → “Connection” → “Limit”.

Why two providers are better

One storage is a single point of failure: a blocked account, an outage at the provider, a bucket deleted by mistake. Connect two storages at different providers and tick both in the protection plan. The backup goes to each one in its own queue: a slow or unavailable one doesn't hold up the other.

In the plan, in the “Where to store” card, the panel shows how many independent copies there are. Two storages in one account are one independent copy: if the account is blocked, both are gone. Fill in the “Account” field, and the panel will notice this.

After connecting, add the storage to the server's plan — Choose what to protect.