Back up anything to S3-compatible object storage
Use rclone or the AWS CLI with a ByteNests bucket, and protect your backups with versioning and object lock.
A backup on the same machine as the data is not much of a backup. Object storage is a cheap, separate place to keep copies of databases, uploads and server files, and it works with the S3 tools you may already use.
Create a bucket for backups
Open Object Storage and choose Create bucket.
Keep access Private. Backups should never be readable by URL.
Turn on Versioning, so overwriting or deleting a file keeps the older copy.
Consider Object lock. Locked files cannot be changed or deleted for a set time, even with valid keys, which protects backups from ransomware and mistakes. It can only be turned on when the bucket is created.
Add a lifecycle rule that deletes old backups after a number of days, so storage does not grow forever.
Give the backup job its own key
Under Object Storage → Access keys, create a key just for this job, with read and write access to the backup bucket only. You can also limit it to your server’s IP address and give it an expiry. The secret is shown once, so copy it straight into your server’s config.
Connect rclone
Use the endpoint and region shown on the Object Storage page. The page also has ready-made snippets for the AWS CLI and boto3.
# ~/.config/rclone/rclone.conf
[bytenests]
type = s3
provider = Ceph
access_key_id = <ACCESS_KEY_ID>
secret_access_key = <SECRET_ACCESS_KEY>
endpoint = <endpoint from the Object Storage page>
region = <region from the Object Storage page>
rclone sync /var/backups bytenests:my-backups/server-1
Put that line in a cron job or a systemd timer and the server copies its backups off the machine every night.
Keep an eye on it
Set a size limit on the bucket to get an email at 80% and 95%. Usage shows storage, downloads and requests per day and per bucket, so you can see what drives the bill. Uploads are free; you pay for what you store, download and request.
Test a restore now and then. A backup you have never restored is only a hope.