Encryption
This changes far more than encryption — the two modes use different tools and store
different things in your bucket. Switching later does not convert existing backups.
| Encrypted (restic) | Not encrypted (rclone) |
|---|
| Objects in S3 | opaque encrypted packs | your actual files, readable |
| Key you can lose | yes — losing it loses everything | none |
| Deduplication | yes | no — stores full size |
| Point-in-time history | full snapshots | mirror + changed files only |
| Restore without this tool | needs restic + the key | aws s3 sync |
Backups will be uploaded with no client-side encryption. Anyone who can read this
bucket — a leaked access key, an over-permissive bucket policy, a misconfigured
replication rule, anyone at your S3 provider — can read every file in it.
This includes your oCIS secrets. ocis-config/ocis.yaml contains the
IDM admin password, the JWT signing secret and the machine auth key. In plaintext, in
your bucket, those are enough to impersonate any user on your instance. Restrict bucket
access accordingly, or exclude that file and store it separately.
Note that oCIS blobs are named by UUID on disk, so "readable" means the files are not
encrypted — it does not mean the bucket will show browsable per-user folders.
Server-side encryption
Applied by S3 after upload, with keys your provider holds. Worth enabling either way, and
close to essential when client-side encryption is off — but it protects data sitting in
the bucket, not from anyone whose credentials can read it.