Storages

A storage is an S3 bucket at any provider: Hetzner, Scaleway, Wasabi, AWS, MinIO and other S3-compatible ones. The storages are yours: arcula puts encrypted backups there and watches over them.

What arcula puts in the bucket

Inside the storage prefix, arcula uses only two places:

• arcula/<server id>/ — the server's restic repository, a separate one for each server in each storage. Each has its own password, created by the panel;
• .arcula-check/ — test objects of the access check.

The repository is plain restic: you can open it without arcula, with the password and keys from the recovery kit.

How many storages

Two is better — at different providers and in different accounts. Then a provider outage, a blocked account or a lost bucket still leaves the second copy.

• In a server's plan, one storage is primary, the others are secondary. Uploads to them are the same; each has its own queue.
• The “Account” field when connecting is a note for yourself. If two storages have the same account, the panel warns: “… are in the same account: if the account is blocked, both copies are lost.” The plan shows “independent copies: N”.

Whose key

When connecting, you choose “Whose key”:

An own key makes sense if the provider supports per-prefix keys. If keys can only cover the whole bucket, there's no isolation — then “One for all servers” is simpler.

Server keys are set after connecting: storage → “Connection” → “Server keys” → “Set key”. The panel checks the key in the server's folder before saving. Until there is a key, this server's backups don't go here: “no key set for the server — backups aren't sent here”. The key entered when connecting stays with the panel — for checks, measurements and cleanup.

To change the mode — “Connection” → “Change mode”. Changing the key or the mode creates a new plan revision for all servers of the storage: agents get the new access on their next check-in.

No deletion protection

The agent writes to S3 itself, directly, with the storage key or its own key. The same key can also delete. So anyone who gets root on a server can delete backups:

• with “One for all servers” — of all servers in this storage;
• with “Each server has its own” — only of this server.

This applies to every storage in the server's plan: the agent gets access to all of them. A second storage saves you from a provider outage, but not from a compromised server.

arcula doesn't build an intermediary between agents and S3 that would forbid deletion — this is a deliberate decision. Deletion protection is on the storage owner's side, at the provider. arcula doesn't configure or check it; the “Connection” tab only shows S3's answers about versioning and Object Lock, as they are. The panel says this plainly: “Deletion protection — none”.

Two more consequences:

• the panel holds storage keys with delete rights — cleanup and data deletion use them. Compromising the panel together with its master key opens all storages;
• if you disconnect a server, its S3 keys stay on it. The panel tells you what to rotate: with a shared key — the storage key, which all its servers have; with an own key — this server's key.

Limit and “Lasts for”

The limit is your budget in the panel, not the provider's quota: S3 has no common way to find out the quota. It's set when connecting, or on the “Connection” tab → “Limit”.

• Without a limit, the panel shows only the size and growth per day: “no limit”.
• With a limit — “Used”: how much of the limit, a bar and how much is left.
• “Lasts for” — when the space up to the limit runs out at the current growth. How it's calculated and what “not enough data” means — Space and “Lasts for”.
• 90% used or more, or less than 30 days left — a warning.

Backups themselves don't stop when space runs short. Only cleanup frees space; while it's off, used space only grows.

Data that isn't ours

You can also connect a bucket that already has something in it: files, old backups, other restic repositories. Ours is only arcula/<ids of this panel's servers>/ and .arcula-check/. Everything else is “not ours”, including another panel's arcula/ directory.

• arcula never writes, changes or deletes data that isn't ours — it only counts its size.
• When connecting, you see how much data isn't ours and which restic repositories were found.
• “Used” is only our data. Data that isn't ours is shown separately: “1.2 TB of data that isn't ours — arcula doesn't touch it.” This is a fact, not a problem.
• By default the limit is counted over our data. When connecting, you can check “count the limit over the whole bucket, including data that isn’t ours”.
• If the bucket has another panel's arcula/ directory and it isn't your previous panel, choose another prefix.

Connect and disconnect

• “Storages” → “+ Storage” → “Check” → “Connect”. Without list, read and write you can't connect: backups won't go there.
• For servers to start writing here, add the storage to the server's plan, in the “Where to store” block.
• “Disconnect storage” — only if it isn't in any plan. The data in the bucket stays.
• “Disconnect and delete data” — after confirmation with a password or passkey. Only the repositories of this panel's servers and .arcula-check/ are deleted; data that isn't ours stays. Deleted data can't be recovered.