Self-hosted PostgreSQL with MinIO or any S3-compatible store

1. Dump with cron

# /etc/cron.d/pg-backup  (as the postgres user)
0 2 * * * postgres pg_dump --format=custom --no-owner orders | mc pipe backups/acme-backups/orders/orders-$(date -u +\%Y-\%m-\%dT\%H-\%M).dump

2. A read-only MinIO user for Verestore

cat > verestore-read.json <<'JSON'
{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": ["s3:ListBucket"],
      "Resource": ["arn:aws:s3:::acme-backups"],
      "Condition": { "StringLike": { "s3:prefix": ["orders/*"] } }
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject"],
      "Resource": ["arn:aws:s3:::acme-backups/orders/*"]
    }
  ]
}
JSON
mc admin policy create backups verestore-read verestore-read.json
mc admin user add backups verestore "$(openssl rand -hex 24)"
mc admin policy attach backups verestore-read --user verestore

The endpoint must be reachable from the internet over HTTPS with a valid certificate for the hosted service. If it isn't, the hosted service can't reach it. Agent mode, which would run the same restore inside your network, is planned, not built: join the waitlist on the pricing page.

The same policy works on Ceph RGW, Garage and SeaweedFS (S3 API with IAM-style policies).