Snapshot destinations

A snapshot destination is one S3-compatible bucket your workspace can target. You configure it once in Settings → Snapshot storage (or via brig snapshot destination add); workloads then reference it by name in TOML.

Why BYO

• You own the storage. Brig never holds tenant data outside of metadata.
• You pay your S3 provider directly. No markup, no surprise egress bills on Brig’s invoice.
• You choose the region. EU residency? Use a Frankfurt bucket. Cheap egress? Use Cloudflare R2.

What works

Any provider that speaks the S3 API + SigV4. We test:

• AWS S3 — leave the endpoint blank.
• Cloudflare R2 — https://<account>.r2.cloudflarestorage.com.
• MinIO — https://minio.example.com (or http://minio:9000 for the local dev walkthrough below).
• Backblaze B2 — https://s3.us-west-002.backblazeb2.com.
• Scaleway, DigitalOcean Spaces, Wasabi, Tigris — same shape.

If a provider supports SigV4 and either path-style or virtual-hosted addressing, it’ll work. Brig auto-flips to path-style for any non *.amazonaws.com host, which covers every non-AWS provider in practice.

Add a destination via CLI

export AWS_SECRET_ACCESS_KEY=<secret>

brig snapshot destination add prod \
  --endpoint https://s3.us-west-002.backblazeb2.com \
  --region us-west-002 \
  --bucket brig-snapshots-prod \
  --access-key-id <key> \
  --secret-access-key-from-env AWS_SECRET_ACCESS_KEY \
  --default

Secret never goes on argv

There is no --secret-access-key flag — a secret on the command line leaks through /proc/cmdline and shell history. Pass it out-of-band with exactly one of --secret-access-key-from-env <VAR>, --secret-access-key-from-file <path>, or --secret-access-key-from-stdin.

Then probe it (writes, reads, and deletes a small object):

brig snapshot destination test prod

Add a destination via dashboard

Settings → Snapshot storage → Add destination. Same fields, same result. Secret access keys are sealed under your tenant DEK on save and never displayed again, even to you.

Defaults

One destination per workspace can be marked default. Workloads that don’t name a destination in their TOML use it. Switch defaults at any time via brig snapshot destination set-default <name>.

Local MinIO {#local-minio}

For local dev or self-hosted backup testing, run MinIO in Docker:

docker run -d --name minio \
  -p 9000:9000 -p 9001:9001 \
  -e MINIO_ROOT_USER=brigtest \
  -e MINIO_ROOT_PASSWORD=brigtest-secret \
  minio/minio server /data --console-address ":9001"

# create the bucket
mc alias set local http://localhost:9000 brigtest brigtest-secret
mc mb local/brig-snapshots

# register with Brig
brig snapshot destination add local-minio \
  --endpoint http://localhost:9000 \
  --region us-east-1 \
  --bucket brig-snapshots \
  --access-key-id brigtest \
  --secret-access-key-from-env MINIO_ROOT_PASSWORD \
  --default

(MINIO_ROOT_PASSWORD is already brigtest-secret in the shell that started the container above — reuse it rather than retyping the secret on argv.)

Reachability

Both Brig’s cp (for the probe) and your agent (for uploads) need to reach the bucket URL. http://localhost:9000 only works if cp and agent are on the same machine. For real VPSes, the bucket must be on the public network or on a tunnel cp can also dial.

Rotating credentials

Re-run the add command with the same name and new credentials. The row is updated atomically; the next snapshot fire picks up the new secret without re-creating the schedule.

Removing a destination

brig snapshot destination remove prod

Existing snapshot rows keep their bucket reference. If you later want to restore one, re-add credentials for the original bucket under any name — Brig resolves by endpoint+region+bucket, not by destination name.