DigitalOcean Spaces

Verified against the provider's documentation, not against a live account.

Managed Database backups stay inside DigitalOcean's service and disappear with the account; a dump in a bucket you control is the copy that survives, and Verestore proves it restores.

1. Write dumps to Spaces

The endpoint is https://<region>.digitaloceanspaces.com, for example https://ams3.digitaloceanspaces.com. With a separate read-write Spaces key for your backup job:

pg_dump --format=custom --no-owner "$DATABASE_URL" \
  | aws --endpoint-url https://ams3.digitaloceanspaces.com --region ams3 \
      s3 cp - "s3://acme-backups/orders/orders-$(date -u +%Y-%m-%dT%H-%M).dump"

If a recent AWS CLI rejects the upload with a checksum or header error, set AWS_REQUEST_CHECKSUM_CALCULATION=when_required for the backup job.

Verestore accepts pg_dump custom format (-Fc) or plain SQL, optionally gzipped. The format is detected from the content, not the file extension.

2. Create a limited-access Spaces key

Spaces keys can be limited per bucket, not per prefix. Use a dedicated bucket per database so the key can read nothing else.

1. In the DigitalOcean control panel, create a Spaces access key named verestore-reader.
2. Choose Limited access.
3. Add the bucket acme-backups with the Read permission, and no other bucket.
4. Copy the access key ID and secret key. The secret is shown once.

Verestore only lists objects under the prefix (ListObjectsV2) and reads orders/*, pinned to the listed ETag. It never writes or deletes.

3. Add the target in Verestore

• S3 endpoint: https://ams3.digitaloceanspaces.com (your bucket's region)
• Region: ams3 (or leave it empty: it is filled from the endpoint)
• Bucket: acme-backups
• Prefix: orders/
• Access key ID and secret access key: from the limited-access key