Back up an app to S3 storage

Use S3-compatible storage in your app's Backup tab to send encrypted backup archives to a bucket you own. This stores backups; it does not replace your app's persistent volume or change where the app saves its uploads.

Before you start

Create a private bucket with your storage provider. Have its HTTPS S3 endpoint, region, access key ID and secret access key ready. Use credentials restricted to the backup bucket or folder rather than your provider's administrator credentials.

The endpoint must have a valid HTTPS certificate and be reachable from the public internet over IPv4. Local addresses, private networks, HTTP endpoints and endpoint redirects are not supported. The connection uses S3 Signature Version 4 and path-style bucket addressing.

Add the destination

1. Open your app in the Caliber Node panel.
2. Select Backup, then Add destination.
3. Enter a destination name and choose S3-compatible storage.
4. Fill in the connection details below.
5. Choose the backup mode and how many backups to keep.
6. For stop-app mode, confirm the downtime checkbox, then click Save destination.
7. Click Test destination and wait for Complete.
8. Click Download recovery key and save it separately from your bucket.
9. Run Back up now or choose an interval under Schedule.

Field	What to enter
HTTPS endpoint	The provider's S3 service URL, without a bucket name or folder path
Bucket name	The name of an existing bucket
Region	The bucket's signing region; use auto for Cloudflare R2
Folder prefix	Optional folder inside the bucket, such as backups
Access key ID	Your S3 access key ID
Secret access key	The matching secret key
Session token	Only required when your provider gives you temporary credentials

Temporary credentials must remain valid when a scheduled backup runs. They are not automatically refreshed. Destination credentials are encrypted in the panel and are not returned in the destination overview.

Provider details

For Amazon S3, use the regional S3 endpoint for your bucket, for example https://s3.us-east-1.amazonaws.com, with region us-east-1. Enter the bucket separately. Use a general-purpose bucket with data immediately available for reads.

For Cloudflare R2, use the account's S3 API endpoint shown in the dashboard, normally https://ACCOUNT_ID.r2.cloudflarestorage.com, and region auto. Use S3 credentials, not a general Cloudflare API token. See Cloudflare's S3 API documentation.

For Backblaze B2, use the S3 endpoint and matching region shown for your bucket, with an application key permitted to access it. See Backblaze's S3-compatible API guide.

For MinIO or another compatible service, enter its public HTTPS S3 API endpoint and configured region. The administration console URL is not the S3 API endpoint.

The transport has been tested against a MinIO S3 server, including multipart uploads and full app restore tests. Provider permissions and compatibility can differ; test your destination and your first backup before enabling a schedule.

Required permissions

Allow object uploads, reads, deletes and cancellation of multipart uploads within the backup folder. On Amazon S3 these correspond to s3:PutObject, s3:GetObject, s3:DeleteObject and s3:AbortMultipartUpload. Bucket policies or encryption-key policies may impose additional requirements.

The panel uses the bucket you provide; it does not create buckets or request public access. Object keys have this structure:

YOUR_PREFIX/caliber-apps/APP_ID/BACKUP_ID.cnb

If you leave the prefix empty, keys start with caliber-apps/. Retention deletes only the backup objects recorded for that destination, not other files in the bucket.

Verification and retention

Archives are encrypted before upload. Large archives use multipart uploads, and failed parts can be retried. After upload, the archive is downloaded and its checksum checked before the backup is marked complete. An S3 ETag alone is not used as proof that the archive is intact.

Choose how many backups to keep when creating the destination. Older backups are removed after a new verified backup completes. Bucket versioning can retain older object versions even after a delete; use your provider's lifecycle rules to manage those versions and their storage charges. Object locks can prevent retention deletion.

Enable a provider lifecycle rule to clean up abandoned multipart uploads as an additional safeguard. See Amazon's multipart upload guidance.

Storage, requests and downloads may incur provider charges. Verification and restore tests download the archive, so account for those transfers when choosing a schedule.

Test a restore

Next to a completed backup, click Test restore. It downloads and decrypts the archive, then starts an isolated copy without replacing your current app. This is a recovery test, not an in-place restore. Contact support if you need to recover the actual app.

The same full app backup limits and backup modes apply, including the current 100 GiB persistent-data limit and app-specific live-backup qualification.

Troubleshooting

Message or symptom	What to check
Access denied	Access key, secret, region, bucket permissions and temporary-token expiry
Redirected request	Use the correct regional service endpoint without a bucket path
Bucket or object not found	Bucket name, endpoint and whether a lifecycle rule removed the archive
Connection or certificate failure	Public IPv4 reachability, valid certificate and correct S3 API URL
Multipart upload fails	Upload and abort permissions, provider limits and any bucket policy restrictions
Old versions still consume space	Provider versioning and lifecycle rules; deleting a current object may leave older versions

Do not paste access keys, secret keys or recovery keys into public messages. Include the app name, job time and displayed error when contacting support.