Storage: S3, SFTP and local disk

Backups live in restic repositories. restic does storage, deduplication and encryption; Sard connects the storage and watches the backups. Data goes from the agent straight to storage and never through the server.

Supported storage

S3-compatible storage, with presets for AWS, Backblaze B2, Yandex Cloud, VK Cloud and Selectel.
An SFTP server.
The host’s local disk.

Connect it with one command

The address, keys and repository password live on the agent host. S3 is connected with one command:

sudo sard-agent repo add main s3:https://<s3.example.com>/<bucket>/<path> \
  --access-key-id <key id> --region <region> --secret-key-from-file /root/s3.secret

Keys stay on the host

The Sard server holds no storage keys: repositories, secrets and scripts are defined on the agent host and referenced by name. The console shows a recovery key flag for a repository: present, absent or unknown.

The verifier gets a repository key of its own and read-only access to storage: the source’s password is not moved to the verifier.

After connecting, sard-agent check verifies the address, keys, repository password and locks, and names the cause when something is refused.

Backup of Sard itself

Every night Sard’s database, CA keys and configuration go through the built-in agent into a repository of your choice. The console warns when that backup is overdue or failing.