backup_targets

Accepted, not yet executable

The loader validates this block and it is published in the JSON Schema, so your editor will complete it. The behaviour behind it is an open proposal. Declaring it changes nothing on the target.

This page is generated from the same Go declarations the loader enforces, so it cannot drift from what ob validate accepts.

Fields on this page

access_key_entry · bucket · cold · credentials · encryption · endpoint · failure_domain · file · host · identity · kind · pitr · prefix · provider · region · secret_key_entry · session_token_entry · snapshot · tls

Reference

Field	Type	Default	What it does
<name>.bucket	string	—	Existing destination bucket used by this target. Expects a lower-case S3-compatible bucket name between 3 and 63 characters.
<name>.credentials	object	—	Trusted encrypted-file entries containing destination credentials; values never appear in the project.
<name>.credentials.access_key_entry	string	—	Variable name containing the destination access key. Expects a variable name of letters, digits and underscores, not starting with a digit.
<name>.credentials.file	string	—	Repository-relative encrypted credential file staged through the trusted secret flow. Expects a path inside the repository, with no control character or shell metacharacter.
<name>.credentials.provider	sops	sops	Trusted secret provider. Only sops is currently executable.
<name>.credentials.secret_key_entry	string	—	Variable name containing the destination secret key. Expects a variable name of letters, digits and underscores, not starting with a digit.
<name>.credentials.session_token_entry	string	—	Optional variable name containing a temporary destination session token. Expects a variable name of letters, digits and underscores, not starting with a digit.
<name>.encryption	object	—	Required encryption mode for each recovery kind this target may store.
<name>.encryption.cold	client-side · archive-password · server-side-sse	—	Encryption mode required for cold recovery: client-side, archive-password, or server-side-sse.
<name>.encryption.pitr	client-side · archive-password · server-side-sse	—	Encryption mode required for point-in-time recovery: client-side, archive-password, or server-side-sse.
<name>.encryption.snapshot	client-side · archive-password · server-side-sse	—	Encryption mode required for snapshot recovery: client-side, archive-password, or server-side-sse.
<name>.endpoint	string	—	Destination API endpoint. HTTPS is required unless tls is explicitly insecure. Expects an http or https URL.
<name>.failure_domain	object	—	Operator-declared identity used to prove the destination does not share the protected host.
<name>.failure_domain.host	string	—	Destination host identity used to refuse a target on the protected host. Expects a stable identifier of letters, digits, dots, colons, slashes, underscores and hyphens.
<name>.failure_domain.identity	string	—	Stable operator-owned failure-domain identity, distinct from the protected host. Expects a stable identifier of letters, digits, dots, colons, slashes, underscores and hyphens.
<name>.kind	s3-compatible	—	Destination kind. Only s3-compatible is supported.
<name>.prefix	string	—	Non-secret object prefix reserved for Onebox protection data. Expects a relative object prefix with no empty leading component or shell metacharacter.
<name>.region	string	—	S3-compatible region when the endpoint requires one. Expects a lower-case S3-compatible region of letters, digits and hyphens.
<name>.tls	required · insecure	required	TLS verification policy: required or insecure.