Store copies in several destinations
With a license, one backup can be stored in several destinations at once, for example a MinIO server on site and a bucket with a cloud provider. Every destination gets a full, independently encrypted copy, so losing one bucket or provider doesn't lose your backups. [!NOTE] Storing copies in more than one destination requires a license. Without one, each backup uses a single destination. See License. Set it up In the guided setup's Destination step, tick more than one destination. The review summary then says a full copy in each. You can add or remove destinations later by editing the backup. See Create a backup. Each destination needs credentials for the backup's credential tier (write, by default). For automatic repair (below), give each destination restore credentials as well. How copies are written The agent reads the source data once and sends it to every destination at the same time. Each copy is encrypted with its own destination's key and uploaded independently. A failing destination doesn't stop the others. If one destination fails, it's dropped from the run and the other copies carry on. A stalled destination is let go. Each destination has its own buffer, so a slower destination doesn't hold back the faster ones. A destination that accepts no data for 2 minutes is dropped from the run. A hung destination therefore can't stall the healthy copies, or keep a stack's containers stopped. A run that reaches some destinations but not all is recorded as a partial run. The run's details list which destinations succeeded and which failed. Automatic repair of missing copies When a run misses a destination, the server re-creates the missing copy from a good one. It reads the good copy, re-encrypts it from the source destination's key to the target destination's key, and uploads it. The copy keeps the target destination's recovery passphrase block, so offline recovery works for repaired copies too. The new copy's size and SHA-256 are checked, and nothing is staged on disk. Repair happens: right after the partial run is reported, every 30 minutes, for partial runs from the last 7 days, until the destination is reachable again, and on demand: on the Backups page, choose Re-create missing copies on a backup. The server reads the good copy with that destination's restore credentials (or management credentials), and writes the new copy with the target's write credentials (or management credentials). The Copies column on the Backups page shows how many of the configured copies exist, for example 2 of 2. A backup with a missing copy is highlighted, and you can hover over it to see how many destinations are missing it. Restores fall back to another copy A restore from the console carries every recorded copy of the archive. If the chosen copy can't be downloaded or opened, the agent moves on to the next destination's copy before writing anything. One unavailable bucket therefore doesn't block a recovery. See Restore backups.
BackupMunk Enterprise documentation