Like others, I’m looking for a way to back up to a cloud provider and have some assurance that the files don’t get overwritten or tampered with for a period of time (I don’t want a fully append-only setup as I do want to expire backups after a certain age to reclaim space). We’re using Wasabi at the moment as our backend.
Wasabi has a “compliance” setting that prevents files from being deleted for a configurable number of days. Unfortunately, this policy is bucket-wide, and once set it prevents restic from cleaning up its lock files (because nothing can be deleted until its age is greater than the policy limit).
Someone hacked around this by using rclone:
The approach is to use two buckets: one for data (with the retention policy applied) and one for locks (with no such policy). They set up two rclone instances (one for each bucket) and then use a proxy to transparently redirect the “lock” requests to the instance that doesn’t enforce a retention policy.
To avoid all of that, could a feature be added to restic where one can override the storage system for locks specifically? In the most minimal case, just specifying a different bucket would work (all other params would stay the same), but for maximum flexibility allowing the user to specify a full second storage system would be ideal (they could revert to a local file system or another provider if desired). Finally, exposing this functionality via environment variables would be great so we can bake it into scripts.
Thanks!