Cloud resource

Configuration directives for the Cloud resource. Every directive is listed; value types and defaults are noted where the source provides them.

Access Key

Access Key = <String>

The access key is your unique user identifier given to you by your cloud service provider.

Bucket Name

Bucket Name = <Name>

This directive specifies the bucket name that you wish to use on the Cloud service. This name is normally a unique name that you create on the cloud service that identifies where you want to place your Cloud Volumes. The maximum bucket name size is 255 characters.

Description

Description = <Text>

The description is used for display purposes as is the case with all resource.

Driver

Driver = <DriverName>

This defines which storage driver to use. Accepted values are S3, Amazon, Oracle, Swift, Azure, Google, GCS, OCI and File; any other value is rejected at config-validation time.

• S3, Amazon, Oracle and Swift select the built-in S3-compatible backend (AWS Signature V4 over the S3 API). No extra package is required.
• File is the built-in local-directory backend used mostly for testing.
• Azure, Google / GCS and OCI are served by external driver packages (see Driver Command below and How cloud drivers resolve). They have no built-in backend, so the matching backup-cloud-driver-<name> package must be installed on the Storage Daemon host for the driver to load.

Driver Command

Driver Command = <path-to-driver-binary>

Explicitly routes this Cloud resource to an external storage-driver helper, overriding the automatic name-based lookup. When set, the Storage Daemon runs the named binary as a subprocess and speaks the cloud-driver protocol to it. Leave it unset to let the SD resolve the driver from the Driver name (an installed backup-cloud-driver-<name> in /opt/backup/cloud-drivers/ is used automatically; otherwise the built-in backend handles it).

Host Name

Host Name = <Name>

This directive specifies the hostname to be used in the URL. Each Cloud service provider has a different and unique hostname. The maximum size is 255 characters and may contain a TCP port specification. This directive is not used with Azure cloud.

Maximum Concurrent Downloads

Maximum Concurrent Downloads = <number>

The default is 3, but by using this directive, you may set it to any value you want.

Maximum Download Bandwidth

Maximum Download Bandwidth = <speed>

The default is unlimited, but by using this directive, you may limit the download bandwidth used globally by all devices referencing this Cloud resource.

Maximum Upload Bandwidth

Maximum Upload Bandwidth = <speed>

The default is unlimited, but by using this directive, you may limit the upload bandwidth used globally by all devices referencing this Cloud resource.

Name

Name = <Device-Name>

The name of the Cloud resource. This is the logical Cloud name, and may be any string up to 127 characters in length.

Object Lock

Object Lock = <Governance | Compliance | None>

Enables WORM immutability for uploaded parts. When set to Governance or Compliance, the object store refuses to delete or overwrite the backup data until its retention date passes — protection against ransomware and accidental or malicious deletion. Compliance cannot be shortened or removed for the duration of the retention; Governance can be adjusted by suitably privileged principals. The default is None (no lock; the bucket default, if any, applies). Set Object Lock Retention to a non-zero period — a mode without a retention is sent as no lock at all.

Per-driver behavior (the same two directives drive every cloud driver):

• S3 (driver ≥ 1.1.0): each part upload carries x-amz-object-lock-mode + retain-until date. The bucket must be created with Object Lock enabled (it cannot be turned on later).
• Azure Blob: each Put Blob carries the per-blob immutability policy (Governance → unlocked, Compliance → locked). The container (or account) must have version-level immutable storage enabled.
• Google Cloud Storage: each insert carries an object retention (Governance → Unlocked, Compliance → Locked). The bucket must be created with per-object retention enabled (--enable-per-object-retention).
• OCI Object Storage: OCI has no per-object lock — WORM is bucket-level retention rules. With a mode set, the OCI driver verifies at connection time that the bucket carries a retention rule at least as long as the configured retention (indefinite rules qualify) and refuses the device otherwise, rather than silently uploading unlocked objects. Compliance additionally requires that rule to be under an already effective compliance lock: a rule whose lock is still inside OCI’s ~14-day grace window (timeRuleLocked in the future) is refused, because it can still be deleted by an administrator until the lock takes effect (driver 1.2.1+). Create a bucket retention rule (oci os retention-rule create) or leave Object Lock = None.

Object Lock Retention

Object Lock Retention = <time-period-specification>

The retention period for Object Lock: each uploaded part is stamped with a retain-until date of upload time plus this period, and the object store refuses to delete or overwrite it before then. 0 (the default) sends no retain-until date even when a lock mode is set — the parts upload unlocked unless the bucket carries a default retention rule, and the driver logs a WARNING in the Storage Daemon journal at connection time to flag exactly that (drivers 1.1.1+). Note that a bucket-level default retention rule, if configured, applies independently of this directive — verify which one stamped an object by comparing its retain-until date against the upload time.

Protocol

Protocol = <HTTP | HTTPS>

The protocol defines the communications protocol to use with the cloud service provider. The two protocols currently supported are: HTTPS and HTTP. The default is HTTPS.

Region

Region = <String>

The Cloud resource can be configured to use a specific endpoint within a region. This directive is required for AWS-V4 regions. ex: Region = “eu-central-1”

Secret Key

Secret Key = <String>

The secret key is the security key that was given to you by your cloud service provider. It is equivalent to a password.

Storage Class

Storage Class = <class-keyword>

Sets the storage tier the driver requests when uploading parts. The keyword is case-sensitive and must come from the set the driver accepts:

• Azure tiers: Hot, Cool, Cold, Archive
• AWS S3 classes: STANDARD, STANDARD_IA, ONEZONE_IA, INTELLIGENT_TIERING, GLACIER, GLACIER_IR, DEEP_ARCHIVE, REDUCED_REDUNDANCY
• Default / None — leave the tier unset and use the bucket/account default.

Archive-class tiers (S3 Glacier family, Azure Archive) are written cold; restoring from them triggers a rehydration governed by Transfer Priority and Transfer Retention.

Transfer Priority

Transfer Priority = <High | Medium | Low>

When restoring directly a part from Glacier, this directive indicates the rehydration priority level. Values can be High, Medium or Low. Default is High. Those values match respectively Expeditive, Standard and Bulk transfers tiers within S3.

Transfer Retention

Transfer Retention = <time-period-specification>

This directive indicates the number of days S3 should keep the rehydrated part online. The minimum value is 1 day. The default is 5 days.

Truncate Cache

Truncate Cache = <Truncate-kw>

This directive specifies when NGBackup should automatically remove (truncate) the local cached volume data. Cached data can only be removed if it has been uploaded to the cloud. The currently implemented values are:

No Do not remove cache. With this option you must manually free cache space with the cloud truncate (one volume) or cloud prune (all uploaded volumes) console commands, or do so with an Admin Job that runs them. This is the default.

AfterUpload (also accepted: AtEndOfJob) After the volume-close upload succeeds, the cached volume file is cut back to its label record; the data lives in the cloud and is re-downloaded on demand when the volume is opened for restore.

Upload

Upload = <Upload-kw>

This directive specifies when NGBackup uploads a volume’s data to the cloud. No never uploads automatically (manual cloud upload only). Manual likewise restricts uploads to the cloud upload console command. AtEndOfJob, EachJob, EachPart, Always and Yes upload the volume’s parts when the volume is closed at the end of the job, with retries; parts already present in the cloud are skipped.

Uri Style

Uri Style = <VirtualHost | Path>

This directive specifies the URI style to use to communicate with the cloud service provider. The two Uri Styles currently supported are: VirtualHost and Path. The default is VirtualHost.