Storage destinations
A destination is a bucket in your object storage where backups are kept. BackupMunk works with AWS S3, Backblaze B2, MinIO and other S3-compatible services. Every destination has its own encryption key, its own credentials and its own retention setting. Add a destination Open Destinations and choose + Add destination. Field What to enter Name A name you'll recognise when choosing where a backup goes. Kind MinIO / S3-compatible, AWS S3 or Backblaze B2. Endpoint The storage service's host name (and port, if it isn't the default), for example s3.us-east-1.amazonaws.com. Bucket The bucket to store backups in. Region Optional. The bucket's region, for example us-east-1. HTTP proxy Optional. A proxy to reach the storage through, for example http://proxy:3128. Use SSL Connect to the endpoint over HTTPS. Keep latest N backups Retention (see Retention). 0 keeps everything. Credentials Up to three sets of access keys (see below). Recovery passphrase Optional, but strongly recommended (see Recovery passphrase). Choose Test connection to check the credentials against the real storage before saving, then Create destination. Three sets of credentials Each destination can hold three independent sets of access keys, so that each part of BackupMunk only gets the access it needs: Credentials Access Used for Management Full control of the bucket Bucket operations, retention, and as a fallback when the other credentials aren't set Restore Read Restoring backups, browsing and downloading archives, and finding existing backups in the bucket Write Write Uploading backups. These are the keys handed to clients that upload directly Create the keys in your storage provider with matching permissions. With write-only keys, a compromised host can upload backups but can't read or delete what's already stored. To be offered when you set up a backup, a destination needs credentials for the tier the backup uses. By default that's write (see Create a backup). On the destinations list, the buttons for each credential tier (management, restore, write) test the stored keys and show ok or fail. The M / R / W column shows which credentials are set, and Key shows that the destination has its encryption key. Saved secret keys are never shown again. When you edit a destination, leave a credential field blank to keep the stored value. Encryption Backups are always encrypted. Each destination has its own 32-byte encryption key, generated by the server when the destination is created or first used. Archives are encrypted on the client before upload and decrypted on the client during a restore, so the storage only ever holds encrypted data. You can't turn encryption off. Next to every backup, the agent writes a small plaintext manifest (<archive>.bmeta.json). It records which backup and host it came from, when it was taken, what it contains, its size, and the SHA-256 and SHA-1 of the stored object. The manifest lets BackupMunk, or a person with access to the bucket, list and check backups without the database or any key. Recovery passphrase [!WARNING] Set a recovery passphrase on every destination. It is what makes offline recovery possible. Without it, your backups can only be decrypted through a working BackupMunk server that still has its BMENT_ENC_KEY. When you set a recovery passphrase, the server derives a key from it (Argon2id) and stores the destination's encryption key, wrapped under that key, in every backup written from then on. The passphrase itself is never stored. With the passphrase and a backup file, the free bmrecover tool decrypts and restores the backup on any machine, with no server, database, master key or license. See Restore backups. Only backups written after you save the passphrase can be recovered with it. Existing backups are not changed. Keep the passphrase somewhere safe and separate from the server, such as your password manager or a sealed envelope. If you lose it, offline recovery isn't possible, but restores through the server still work…
BackupMunk Enterprise documentation