Skip to main content

Backups

Infrastructure backup is a deliberate gap here, not an oversight — see Framework → Security → Backups for the full reasoning. The server itself is reproducible from OpenTofu: rebuilding it is faster and more consistent than restoring a snapshot, and a snapshot backs up plenty of reproducible data (container images, disposable OS install) not worth the cost of protecting. What actually needs backing up is service-level data — the databases and files each app owns that OpenTofu can't reproduce.

1. The backups bucket​

pc-backups — already created, managed in OpenTofu (storage.tofu).

2. Add it as an S3 storage destination in Coolify​

In the Coolify dashboard, add a new S3 storage destination (exact navigation label varies by version — Storage or S3 Storages in the sidebar) with:

  • Endpoint — https://s3.pub2.infomaniak.cloud
  • Port — 443
  • Bucket — pc-backups
  • Region — us-east-1. Not where the bucket actually lives (dc4-a) — this is the SigV4 signing region Infomaniak's S3 gateway expects regardless, the same constant Infrastructure as Code's own state backend already uses.
  • Access Key / Secret Key — from <prefix>-openstack-s3-access-key in Proton Pass.
  • Path-style requests — enable if the option exists. Infomaniak's gateway needs it (use_path_style = true in this project's own OpenTofu backend config) — likely needed here for the same reason.

Validate the connection before moving on — Coolify runs a ListObjects call against it to confirm the credentials and endpoint actually work.

3. Enable backups for Coolify itself​

Its own instance backup, not a resource — Settings → Backup, separate from step 4 below. Covers coolify-db (projects, applications, env vars, deployment history) and /data/coolify's config files. Select Configure Backup, pick the pc-backups destination.

4. Enable backups per service​

Not global — configured on each resource that actually holds state (a database, mainly). Open the resource → Backups tab → enable, pick the pc-backups destination, set a schedule and retention. Coolify asks the database for a native dump where it knows how to, rather than a blind file copy — worth confirming per resource, not assumed, since it does not solve the coverage problem for anything living in object storage rather than that database.