Wasabi

Verified against the provider's documentation, not against a live account.

A provider snapshot disappears with the account that holds it; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.

1. Write dumps to Wasabi

Use the regional endpoint https://s3.<region>.wasabisys.com, for example https://s3.eu-central-1.wasabisys.com. With a separate read-write key for your backup job:

pg_dump --format=custom --no-owner "$DATABASE_URL" \
  | aws --endpoint-url https://s3.eu-central-1.wasabisys.com --region eu-central-1 \
      s3 cp - "s3://acme-backups/orders/orders-$(date -u +%Y-%m-%dT%H-%M).dump"

If a recent AWS CLI rejects the upload with a checksum or header error, set AWS_REQUEST_CHECKSUM_CALCULATION=when_required for the backup job.

Verestore accepts pg_dump custom format (-Fc) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.

2. Create a read-only policy

Wasabi supports AWS-compatible IAM policies. In the Wasabi console, create a policy named verestore-read with:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Sid": "ListOnlyThePrefix",
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::acme-backups",
      "Condition": { "StringLike": { "s3:prefix": ["orders/*"] } }
    },
    {
      "Sid": "ReadOnlyThePrefix",
      "Effect": "Allow",
      "Action": "s3:GetObject",
      "Resource": "arn:aws:s3:::acme-backups/orders/*"
    }
  ]
}

3. Create a sub-user for Verestore

1. Create a user named verestore-reader with programmatic (API key) access only, no console access.
2. Attach the verestore-read policy and no other policy or group.
3. Create an access key for the user and copy the access key and secret key. The secret is shown once.

Verestore only lists objects under the prefix (ListObjectsV2) and reads orders/*, pinned to the listed ETag. It never writes or deletes.

4. Add the target in Verestore

• S3 endpoint: https://s3.eu-central-1.wasabisys.com (your bucket's region, in the s3.<region> form)
• Region: eu-central-1 (or leave it empty: it is filled from the endpoint)
• Bucket: acme-backups
• Prefix: orders/
• Access key ID and secret access key: from the sub-user's key