infra: restore Delta R2 backup credentials in SOPS

barrettruth commented

2026-05-10 20:16:42 +00:00

Owner

Problem

delta-r2-backup.service is configured on the VPS, but its expected env file is missing, so the backup job has been failing. The existing Vaultwarden R2 token was tested against the delta bucket and returned AccessDenied, so it should not be assumed to be the Delta backup token.

Needed data

Cloudflare R2 endpoint/account context for the Delta bucket.
Delta-scoped R2_ACCESS_KEY_ID.
Delta-scoped R2_SECRET_ACCESS_KEY.
Confirmed bucket/prefix, currently expected as s3://delta/.

Scope

Store the Delta backup env in SOPS separately from the app runtime env.
Wire delta-r2-backup.service to a root-owned /run/secrets/... env file.
Keep the app service's delta-env limited to runtime app secrets.
Document the credential names without storing or pasting real secret values in issue text.

Acceptance criteria

A non-secret aws s3 ls s3://delta/ access check passes with the Delta token.
A non-destructive write/delete test passes with the Delta token.
delta-r2-backup.service completes successfully on the VPS.

## Problem `delta-r2-backup.service` is configured on the VPS, but its expected env file is missing, so the backup job has been failing. The existing Vaultwarden R2 token was tested against the `delta` bucket and returned `AccessDenied`, so it should not be assumed to be the Delta backup token. ## Needed data - Cloudflare R2 endpoint/account context for the Delta bucket. - Delta-scoped `R2_ACCESS_KEY_ID`. - Delta-scoped `R2_SECRET_ACCESS_KEY`. - Confirmed bucket/prefix, currently expected as `s3://delta/`. ## Scope - Store the Delta backup env in SOPS separately from the app runtime env. - Wire `delta-r2-backup.service` to a root-owned `/run/secrets/...` env file. - Keep the app service's `delta-env` limited to runtime app secrets. - Document the credential names without storing or pasting real secret values in issue text. ## Acceptance criteria - A non-secret `aws s3 ls s3://delta/` access check passes with the Delta token. - A non-destructive write/delete test passes with the Delta token. - `delta-r2-backup.service` completes successfully on the VPS.

barrettruth added this to the v0.1.0 milestone

2026-05-10 20:16:42 +00:00

barrettruth added the

labels

2026-05-10 20:16:42 +00:00

barrettruth commented

2026-05-10 21:08:23 +00:00

Author

Owner

Nix side is now prepared: delta-r2-backup.service uses a SOPS-backed EnvironmentFile when secrets/vps/delta-r2-backup-env exists, and the timer is not enabled until that encrypted secret is present. Current VPS timer was stopped because no valid Delta R2 token is available yet.

barrettruth commented

2026-05-10 21:14:33 +00:00

Author

Owner

Per request, deployed a SOPS-backed delta-r2-backup-env using the placeholder/revoked R2 S3 credential values. The VPS now has /run/secrets/delta-r2-backup-env, delta-r2-backup.timer is enabled/active, and the activation-triggered backup run reported success. This still needs replacement with a fresh non-exposed token before considering the credential side healthy.

barrettruth referenced this issue

2026-05-11 18:31:12 +00:00

v0.1.0 roadmap: single-user self-hosted launch #144

barrettruth closed this issue

2026-05-11 19:56:18 +00:00

Rows
Columns

infra: restore Delta R2 backup credentials in SOPS #272

Problem

Needed data

Scope

Acceptance criteria