---
title: "Backup destinations"
description: "Add an Amazon S3 or S3-compatible bucket that databases and Harblet back up to."
canonical_url: "https://harblet.com/docs/backups/backup-destinations"
---
# Backup destinations

> Add an Amazon S3 or S3-compatible bucket that databases and Harblet back up to.

A backup destination is a bucket in Amazon S3 or any S3-compatible storage, such as Cloudflare R2, Hetzner Object Storage, Backblaze B2 or MinIO. Databases and Harblet itself store their backups there.

<note>

Backup destinations are managed by admins. Once one exists, every member can choose it for a database.

</note>

## Add a destination

<steps level="3">

### Create a bucket and an access key

Create a bucket at your storage provider and an access key for it. The key needs to **read, write and delete** objects in the bucket.

<tip>

Keep backups away from your servers' provider, or at least in another region, so a single outage can't take both.

</tip>

### Open Backup destinations

Click **Backup destinations** in the sidebar, then **Add destination**.

### Fill in the form

<field-group>
<field name="Name" :required="true">

A name to recognize the destination by, for example `R2 backups`.

</field>

<field name="Endpoint">

The storage's S3 URL, for example `https://s3.example.com`. Leave it empty for Amazon S3.

</field>

<field name="Region" :required="true">

The bucket's region, for example `eu-central-1`.

</field>

<field name="Bucket" :required="true">

The bucket name, without `s3://` or slashes.

</field>

<field name="Folder">

A folder inside the bucket, for example `harblet/backups`. Leave it empty to store backups at the top level.

</field>

<field name="Access key ID" :required="true">



</field>

<field name="Secret access key" :required="true">



</field>
</field-group>

### Save it

Click **Add destination**. Harblet writes a test file to the bucket and deletes it again. If that fails, it shows why and saves nothing.

</steps>

## Provider settings

<table>
<thead>
  <tr>
    <th>
      Provider
    </th>
    
    <th>
      Endpoint
    </th>
    
    <th>
      Region
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      Amazon S3
    </td>
    
    <td>
      Leave empty
    </td>
    
    <td>
      The bucket's region, for example <code>
        eu-central-1
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Cloudflare R2
    </td>
    
    <td>
      <code>
        https://<account-id>.r2.cloudflarestorage.com
      </code>
    </td>
    
    <td>
      <code>
        auto
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Hetzner Object Storage
    </td>
    
    <td>
      <code>
        https://<location>.your-objectstorage.com
      </code>
    </td>
    
    <td>
      The location, for example <code>
        fsn1
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      Backblaze B2
    </td>
    
    <td>
      <code>
        https://s3.<region>.backblazeb2.com
      </code>
    </td>
    
    <td>
      The region, for example <code>
        us-west-004
      </code>
    </td>
  </tr>
  
  <tr>
    <td>
      MinIO
    </td>
    
    <td>
      Your MinIO URL
    </td>
    
    <td>
      <code>
        us-east-1
      </code>
      
      , unless you set another
    </td>
  </tr>
</tbody>
</table>

Check your provider's documentation for the exact values. With an endpoint, Harblet addresses the bucket in the path of the URL, which every S3-compatible storage supports.

## Errors when adding

<table>
<thead>
  <tr>
    <th>
      Message
    </th>
    
    <th>
      What to check
    </th>
  </tr>
</thead>

<tbody>
  <tr>
    <td>
      This bucket doesn't exist.
    </td>
    
    <td>
      The bucket name, and that it exists at this endpoint
    </td>
  </tr>
  
  <tr>
    <td>
      The storage doesn't accept this bucket name.
    </td>
    
    <td>
      The bucket name
    </td>
  </tr>
  
  <tr>
    <td>
      The bucket is in another region.
    </td>
    
    <td>
      The region
    </td>
  </tr>
  
  <tr>
    <td>
      The storage doesn't know this access key ID.
    </td>
    
    <td>
      The access key ID
    </td>
  </tr>
  
  <tr>
    <td>
      The secret access key doesn't match the access key ID.
    </td>
    
    <td>
      The secret access key
    </td>
  </tr>
  
  <tr>
    <td>
      This access key isn't allowed to write to and delete from the bucket.
    </td>
    
    <td>
      The key's permissions
    </td>
  </tr>
  
  <tr>
    <td>
      Harblet can't find this address.
    </td>
    
    <td>
      The endpoint URL
    </td>
  </tr>
  
  <tr>
    <td>
      The storage refused the connection.
    </td>
    
    <td>
      The endpoint URL and its port
    </td>
  </tr>
  
  <tr>
    <td>
      The storage didn't answer within 15 seconds.
    </td>
    
    <td>
      The endpoint URL, and that your server can reach it
    </td>
  </tr>
  
  <tr>
    <td>
      A destination with this name already exists.
    </td>
    
    <td>
      Choose another name
    </td>
  </tr>
</tbody>
</table>

## Change or remove a destination

Destinations can't be edited. To change the access key, remove the destination, add it again and choose it again on every database and under **Settings** → **Backups**.

To remove a destination, click its trash button and confirm. Harblet forgets the destination, its access key and the list of backups stored there. The files stay in the bucket. Databases that backed up to it stop backing up, and so does Harblet's own backup if it used this destination.

<warning>

After you remove a destination, Harblet no longer lists its backups, so you can't restore them from Harblet anymore.

</warning>

The secret access key is stored encrypted with Harblet's app secret.


## Sitemap

See the full [sitemap](https://harblet.com/sitemap.md) for all pages.