Jump to content

Kopia S3 Backup to Your Storage Box on PMSS

From Pulsed Media Wiki


Kopia S3 Backup to Your Storage Box points Kopia — a fast, encrypted, deduplicating and compressing backup program — at a self-hosted S3 endpoint running on your own storage box. You run one small S3 server on the box, then any machine with the kopia binary backs up to it over the S3 API: encrypted before it leaves the source, deduplicated and compressed so history is cheap, and restorable to the byte. The repository lives on disk you already pay for, in Pulsed Media's Finnish datacenters, with no per-request and no egress fees.

Kopia does the same job as Restic and picks up two things Restic does not: transparent compression, and snapshot policies (retention, scheduling, compression settings) attached to each source path.

When Kopia over S3

Reach for Kopia-over-S3 when you want an encrypted, snapshotted backup of a machine to disk you control — and you want the extras: compression (so text-heavy data shrinks on the way in), policy-driven retention (keep so many hourly / daily / weekly / monthly / annual snapshots automatically), and a repository your other machines can share. Kopia speaks S3 natively, so an endpoint on your box is a first-class Kopia repository — no cloud provider, no egress bill.

What you need

Two things:

  • An S3 endpoint on your box. The simplest is rclone serve s3 — pre-installed, one command — which is what the walkthrough below uses and was tested against. rclone's S3 server is officially experimental; it handled this backup and restore flawlessly, but if you want the most battle-tested repository for critical data, MinIO and versitygw work as Kopia repositories just as well.
  • The kopia binary on the machine you back up FROM. It is a single static binary; install it from the releases page or your package manager.

The backup, verified

Everything below was run end to end on a Pulsed Media storage box: the endpoint started, a repository created in it, a snapshot taken, and the restore came back byte-identical (verified by SHA-256).

A real Kopia backup to a self-hosted S3 endpoint on a storage box: repository create, snapshot, then a restore whose bytes match the original.

Start the endpoint (non-default port, bound to localhost). The repository password is separate from the S3 access key — it is what encrypts your data, and only you hold it: 

# on the box: a one-command S3 endpoint, and a directory that will be the bucket
mkdir -p ~/s3-bucket/kopiabackup
rclone serve s3 --addr 127.0.0.1:47021 --auth-key 'MYKEY,MYSECRET' ~/s3-bucket &

export KOPIA_PASSWORD="a-strong-repo-passphrase"   # this encrypts everything — keep it safe

Create the repository in the bucket, snapshot a directory, and list it: 

$ kopia repository create s3 \
    --bucket=kopiabackup --endpoint=127.0.0.1:47021 \
    --access-key=MYKEY --secret-access-key=MYSECRET \
    --region=us-east-1 --disable-tls

$ kopia snapshot create ~/mydata

$ kopia snapshot list
you@your-box:/home/you/mydata
  2026-08-14 11:45  kf59460e0a0fe5eebf2169a87d9a31f98  1 MB  files:2 dirs:2  (latest-1,hourly-1,daily-1,weekly-1,monthly-1,annual-1)

Restore it. Kopia's restore takes the snapshot ID from the list above and rebuilds the files directly under the target directory (no path nesting): 

$ kopia snapshot restore kf59460e0a0fe5eebf2169a87d9a31f98 ~/restored
Restoring to local filesystem (/home/you/restored) with parallelism=8...
Restored 2 files, 2 directories and 0 symbolic links (1 MB).

In this test the restored tree was byte-for-byte identical to the original (matching SHA-256 on every file). Inside the bucket you will find Kopia's own repository layout — kopia.repository, kopia.maintenance, and content-addressed blobs — never your plaintext files.

Keep it running

  • Policies do the scheduling. Instead of a cron line per source, set a Kopia policy: kopia policy set ~/mydata --keep-daily 7 --keep-weekly 4 --compression zstd, then run kopia snapshot create from cron and Kopia enforces retention and compression itself.
  • Keep working across a migration. The endpoint's raw address changes if your service is later moved to different hardware. Create the repository against your service permalink (<your-label>.mcx.fi) instead of the server name, and scheduled jobs keep pointing at the right endpoint after a move.
  • Many machines, one repo. The same repository works from your laptop or another server — install kopia there, connect it to the same endpoint (over the permalink, with TLS for anything crossing the network), and Kopia deduplicates across all of them.

Security

Kopia encrypts on the client, before anything is sent, so the box stores only ciphertext — the repository password never leaves your machine and is not recoverable if lost. Keep the S3 endpoint bound to 127.0.0.1 (or behind TLS on your permalink) rather than exposed, and keep the repository passphrase somewhere separate from the S3 keys.

See also

Retrieved from "https://wiki.pulsedmedia.com/index.php?title=Kopia_S3_Backup_to_Your_Storage_Box_on_PMSS&oldid=1004632"