Verestore
Launching shortly

Backblaze B2

Verified against the provider's documentation, not against a live account.

A provider snapshot disappears with the account that holds it; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.

1. Write dumps to B2

B2's S3-compatible endpoint is https://s3.<region>.backblazeb2.com, for example https://s3.us-west-004.backblazeb2.com. The bucket details in the B2 web UI show yours. With a separate read-write key for your backup job:

pg_dump --format=custom --no-owner "$DATABASE_URL" \
  | aws --endpoint-url https://s3.us-west-004.backblazeb2.com --region us-west-004 \
      s3 cp - "s3://acme-backups/orders/orders-$(date -u +%Y-%m-%dT%H-%M).dump"

If a recent AWS CLI rejects the upload with a checksum or header error, set AWS_REQUEST_CHECKSUM_CALCULATION=when_required for the backup job.

Verestore accepts pg_dump custom format (-Fc) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.

2. Create a restricted application key

An application key can be limited to one bucket and a file name prefix. Give it only listFiles and readFiles:

b2 key create --bucket acme-backups --name-prefix orders/ verestore-reader listFiles,readFiles

This is the syntax of the current b2 CLI; older versions use b2 create-key with the same options. Check b2 key create --help for your version. You can also create the key in the B2 web UI with the same bucket, prefix and read-only access.

The output contains the keyID (the access key ID) and the applicationKey (the secret access key). The application key is shown once.

Verestore only lists objects under the prefix (ListObjectsV2) and reads orders/*, pinned to the listed ETag. It never writes or deletes.

3. Add the target in Verestore

  • S3 endpoint: https://s3.us-west-004.backblazeb2.com (your bucket's region)
  • Region: us-west-004 (or leave it empty: it is filled from the endpoint)
  • Bucket: acme-backups
  • Prefix: orders/ (the same as the key's name prefix)
  • Access key ID: the keyID; secret access key: the applicationKey