OVHcloud Object Storage (S3-compatible)

Verified against the provider's documentation, not against a live account.

Managed database backups stay inside OVHcloud's service and disappear with the project; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.

1. Write dumps to Object Storage

The S3 endpoint is https://s3.<region>.io.cloud.ovh.net, for example https://s3.gra.io.cloud.ovh.net (also de, sbg and others). The bucket's details in the Control Panel show yours. With separate read-write credentials for your backup job:

pg_dump --format=custom --no-owner "$DATABASE_URL" \
  | aws --endpoint-url https://s3.gra.io.cloud.ovh.net --region gra \
      s3 cp - "s3://acme-backups/orders/orders-$(date -u +%Y-%m-%dT%H-%M).dump"

If a recent AWS CLI rejects the upload with a checksum or header error, set AWS_REQUEST_CHECKSUM_CALCULATION=when_required for the backup job.

Verestore accepts pg_dump custom format (-Fc) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.

2. Create an S3 user for Verestore

1. In your Public Cloud project, open Users & Roles and create a user, for example verestore-reader.
2. Generate S3 credentials for that user. The access key and secret key are what you give Verestore.

Check the provider's current documentation for the role the user needs to hold S3 credentials; give it no other access.

3. Attach a read-only S3 user policy

OVHcloud lets you import a JSON policy for an S3 user. Use:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListOnlyThePrefix",
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::acme-backups"],
      "Condition": { "StringLike": { "s3:prefix": ["orders/*"] } }
    },
    {
      "Sid": "ReadOnlyThePrefix",
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::acme-backups/orders/*"]
    }
  ]
}

Which condition keys OVHcloud evaluates may differ from AWS: check the provider's current documentation. If the s3:prefix condition is not supported, remove the Condition block and use a dedicated bucket per database, so listing the bucket reveals nothing else.

Verestore only lists objects under the prefix (ListObjectsV2) and reads orders/*, pinned to the listed ETag. It never writes or deletes.

4. Add the target in Verestore

• S3 endpoint: https://s3.gra.io.cloud.ovh.net (your bucket's region)
• Region: gra (or leave it empty: it is filled from the endpoint)
• Bucket: acme-backups
• Prefix: orders/
• Access key ID and secret access key: the S3 credentials from step 2