Backup Content Access and Download #649

Merged

tobru merged 3 commits from backup-access into main

2026-09-01 06:25:04 +00:00

tobru commented

2026-08-27 14:12:35 +00:00

Owner

Adds the design doc for backup content access and download, the follow-up to the backup visibility work (#544): not "did a backup happen?" but "give me the bytes".

What the spec proposes

Direct bucket access. Users get raw access to their backup data with their own external tools (restic, barman-cloud, aws/rclone); the portal helps by revealing the per-instance bucket credentials (plus the restic repository password where applicable) and rendering ready-made command blocks.

Main design points

Reveal is gated by a new permission (staff or org admin), is a CSRF-protected POST, is audited, and notifies org owners on first reveal (staff reveals audited but no email). Non-admin members see an "ask an organization admin" note.
Credentials are read-write today; the danger warning covers deletion and tampering.
Rotation stays a documented support runbook for now; no self-service rotation.
Out of scope: unmanagedBucket instances, legacy StackGres PostgreSQL, Garage/generic bucket backends. Portal-mediated exports and in-portal browsing were considered and dismissed (recorded in the doc).

Adds the design doc for backup content access and download, the follow-up to the backup visibility work (#544): not "did a backup happen?" but "give me the bytes". ## What the spec proposes **Direct bucket access.** Users get raw access to their backup data with their own external tools (restic, barman-cloud, aws/rclone); the portal helps by revealing the per-instance bucket credentials (plus the restic repository password where applicable) and rendering ready-made command blocks. ## Main design points - Reveal is gated by a new permission (staff or org admin), is a CSRF-protected POST, **is audited**, and **notifies org owners on first reveal** (staff reveals audited but no email). Non-admin members see an "ask an organization admin" note. - Credentials are read-write today; the danger warning covers deletion *and* tampering. - Rotation stays a documented support runbook for now; no self-service rotation. - Out of scope: `unmanagedBucket` instances, legacy StackGres PostgreSQL, Garage/generic bucket backends. Portal-mediated exports and in-portal browsing were considered and dismissed (recorded in the doc).

tobru changed title from ~~WIP: Raw Backup Access~~ to WIP: Backup Content Access and Download

2026-08-27 14:13:30 +00:00

tobru changed title from ~~WIP: Backup Content Access and Download~~ to Backup Content Access and Download

2026-08-31 13:07:52 +00:00

tobru force-pushed backup-access from 5ea151b97d

Tests / test (push) Successful in 1m16s

Details

to 632fedaef5

2026-09-01 06:23:28 +00:00

Compare

tobru merged commit 78509687d9 into main

2026-09-01 06:25:04 +00:00