oCIS S3 Backup

Sign in with the backup service admin account.

🗃 oCIS S3 Backup
Backups are not configured yet. Open Settings, fill in your S3 bucket and an encryption key, press Test connection, then Save.

Repository

—

Last backup

—

Next backup

—

Consistency

—

Encryption

—
No job running.

Live output

Waiting for a job to start…
The settings most installs need.

S3 destination

Encryption

This changes far more than encryption — the two modes use different tools and store different things in your bucket. Switching later does not convert existing backups.

Encrypted (restic)Not encrypted (rclone)
Objects in S3opaque encrypted packsyour actual files, readable
Key you can loseyes — losing it loses everythingnone
Deduplicationyesno — stores full size
Point-in-time historyfull snapshotsmirror + changed files only
Restore without this toolneeds restic + the keyaws s3 sync

Write this key down somewhere that is not this server. It is the only thing that can decrypt your backups. There is no reset, no recovery and no support path — if it is lost, every byte in the bucket is permanently unreadable, including by you.

Changing the key after the first backup makes all existing snapshots unreadable. Keep the old key until you have confirmed you no longer need those snapshots.

This is not the same thing as BACKUP_MASTER_KEY. That environment variable only encrypts this settings file on disk so your S3 credentials are not stored in plaintext. Losing it costs you these settings; losing the encryption key costs you the backups. Keep a copy of both.

Backups will be uploaded with no client-side encryption. Anyone who can read this bucket — a leaked access key, an over-permissive bucket policy, a misconfigured replication rule, anyone at your S3 provider — can read every file in it.

This includes your oCIS secrets. ocis-config/ocis.yaml contains the IDM admin password, the JWT signing secret and the machine auth key. In plaintext, in your bucket, those are enough to impersonate any user on your instance. Restrict bucket access accordingly, or exclude that file and store it separately.

Note that oCIS blobs are named by UUID on disk, so "readable" means the files are not encrypted — it does not mean the bucket will show browsable per-user folders.

Server-side encryption

Applied by S3 after upload, with keys your provider holds. Worth enabling either way, and close to essential when client-side encryption is off — but it protects data sitting in the bucket, not from anyone whose credentials can read it.

When to back up

What to back up

The defaults capture a complete, restorable oCIS instance. Only change these if you know why — removing a path can make a backup that looks fine but cannot be restored.

Consistency

oCIS must be restored as a consistent set of metadata and blobs. Choose how much coordination you want in exchange for downtime.

Retention

Integrity checks

In unencrypted mode this compares every local file against the mirror by size and checksum. Percentage-based re-reads do not apply.

Notifications

Admin password

Snapshots & Restore

TakenIDTypePaths
Loading…

Browse

Download saves the file to your computer under its real name — upload it back through oCIS to put it where it was. One file downloads as itself; several files or a folder download as a zip. Restore to server writes them into /opt/ocis/restore/ instead.

NameSizeModified

This is how oCIS stores data on disk: folders and files are named by ID, not by their real names. Use it to restore the whole instance after a disaster. To find one file by name, use Files instead.

Written to a staging directory, never into the live oCIS volumes.
NameSizeModified

Job history

StartedKindTriggerStateDurationDetail
Loading…

Log