Off-server Storage

Backups on the same disk as the database don’t survive the loss of the server. Turn on Copy backups off the server in Settings → Backup Storage and every backup is uploaded straight from the server after it is encrypted, to S3-compatible storage or Google Drive.

Each backup remembers where its copy went, so switching providers later is safe: restores and retention of older backups keep using the storage they were sent to, as long as it stays configured.

S3-compatible storage

Pick the service and VPSPilot builds the endpoint. Anything that speaks the S3 API with SigV4 signing works; plain http:// endpoints are allowed for storage on a private network.

Cloudflare R2

Create the bucket, then R2 → Manage API tokens → Create API token with Object Read & Write on that bucket. Use the Access Key ID and Secret Access Key it shows (not the token value), and your account ID from the R2 overview page.

Bucket permissions on AWS

The access key needs to read, write and delete objects under the folder. A minimal policy:

{  "Version": "2012-10-17",  "Statement": [    {      "Effect": "Allow",      "Action": ["s3:PutObject", "s3:GetObject", "s3:DeleteObject"],      "Resource": "arn:aws:s3:::my-backups/vpspilot/*"    },    {      "Effect": "Allow",      "Action": "s3:ListBucket",      "Resource": "arn:aws:s3:::my-backups"    }  ]}

Google Drive

VPSPilot connects to Drive through an OAuth client you create, and asks only for the drive.file permission: it sees nothing in your Drive except the files it creates, in a VPSPilot backups folder.

https://pilot.example.com/api/v1/backups/gdrive/callback

The long-lived Google token stays encrypted on the control plane; each backup job gets an access token valid for about an hour, and the server uploads in resumable 8 MiB chunks. Disconnect revokes VPSPilot's access; backups already in Drive stay there.

Test the connection

Test connection asks a server to upload and then delete a small file with the saved settings, so you know uploads will work from the place they actually happen.

POST /api/v1/backups/settings/test?server_id={server_id}

The recovery kit

Backups are encrypted before upload, so the storage provider only ever sees ciphertext, and without the backup key nobody can read them, including you. Download the recovery kit from Settings → Security (it asks for your password and is audited) and keep it offline. It contains the control plane's keys and the backup key, with the commands to decrypt a backup by hand:

export VPB_KEY=…   # from the recovery kit# PostgreSQL (*.pgdump.enc)openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -pass env:VPB_KEY \  -in backup.pgdump.enc | pg_restore --no-owner -d DATABASE# MySQL / MariaDB (*.sql.gz.enc)openssl enc -d -aes-256-cbc -pbkdf2 -iter 100000 -pass env:VPB_KEY \  -in backup.sql.gz.enc | gunzip | mysql DATABASE