HF PanelDocsv1.0.0

Back up off-server to S3-compatible storage

Copy every nightly backup to S3-compatible object storage, encrypt it, test that backups restore, and restore one account from the copy.

Backups on the same server don't help if you lose the server. This tutorial copies every nightly backup to S3-compatible object storage (Amazon S3, Backblaze B2, Wasabi, Cloudflare R2, OVH Object Storage, MinIO and others), encrypts the copies, and proves that a backup really comes back.

You need: an administrator login, and a bucket with an access key and secret key at your storage provider.

1. Make a bucket and key

At your storage provider:

  1. Create a bucket, for example yourdomain-backups, in the region you want.
  2. Create an access key that may read, write, list and delete in that bucket only.
  3. Note the region and, for Cloudflare R2 or another S3-compatible service, the endpoint address.

2. Check the schedule

  1. Open Server Admin › System › Backups.
  2. In Schedule, keep Back up every account each night (around 03:20) ticked and set Keep nightly backups for (7 days by default).
  3. Click Save.

3. Turn on off-server copies

  1. In Off-server copies, tick Copy backups off the server.

  2. Fill in:

    Field What to enter
    Storage your provider, or Other S3-compatible (MinIO…)
    Region for example eu-west-2; empty = the provider's usual region
    Endpoint only for Cloudflare R2 and Other
    Bucket yourdomain-backups
    Folder in the bucket keep hostfog, or choose your own
    Access key / Secret key the key from step 1
    Keep copies for for example 30 days
    Encryption passphrase at least 12 characters (recommended)

  3. Click Save and test.

HF Panel connects to the storage before it saves. If the test fails, nothing is saved and the message says why.

Warning: store the encryption passphrase somewhere safe, away from the server. Without it the copies can't be read, not even by HF Panel.

4. Copy the newest backups now

Click Copy newest backups now so you don't have to wait for tonight. The card then shows the result of the last copy.

5. Keep the key file safe

At the bottom of Server Admin › System › Backup storage, the screen shows the path of the server's own key file that encrypts saved secrets. Copy that file somewhere safe as well: it is never part of the panel's backups.

6. Add a second destination (optional)

For an extra copy, open Backup storage › Off-server destinations, click Add a destination, choose SFTP server, Backblaze B2 or Google Drive, tick Copy backups here every night and click Save. See Backup storage.

7. Test that backups restore

  1. Back on Backups, in Restore test, click Test the newest backups now and confirm.
  2. When it finishes, the card shows All good or how many failed, and each account's Restore test column shows OK or Failed.

The same test runs every week by itself and emails you if one fails.

8. Restore one account from the off-server copy

Do this once on a test account, so you know the steps before you need them:

  1. In the accounts table on Backups, click Open next to the account. Its Control Panel opens.
  2. Open Files › Backups. Under Off-server copies, click Restore next to a copy.
  3. The copy is brought back to the server first, then restored like any backup: choose What to restore, type RESTORE and click Restore.

9. Keep the panel's own data safe

The Copies of the control panel data card copies logins, accounts, packages, invoices and settings every night, also to the storage. If the panel ever breaks, sudo hf-panel panel-restore <name> puts one back without touching websites, email or databases.