Encrypted S3 Backups Free

Add transparent encryption at rest to any S3-compatible storage used for database backups — with zero changes to your backup workflow.

Overview

Coolify supports uploading database backups to S3-compatible storage (AWS S3, MinIO, Backblaze B2, etc.). Encrypted S3 Backups adds a transparent encryption layer using rclone's crypt backend (NaCl SecretBox), so your backups are encrypted before they leave the server.

• Per-storage toggle — enable encryption on individual S3 storages, not globally
• Transparent — existing backup schedules continue working without modification
• Strong encryption — NaCl SecretBox (XSalsa20-Poly1305) for file contents
• Optional filename encryption — hide file names on S3 for additional privacy
• Compatible — works with any S3-compatible storage provider

How It Works

When encryption is enabled on an S3 storage:

1. Database backups are created normally (pg_dump, mysqldump, etc.)
2. Instead of uploading directly via the mc (MinIO Client) tool, backups are uploaded through rclone's crypt layer
3. Rclone encrypts the file contents (and optionally filenames) before uploading to S3
4. Downloads and restores automatically decrypt through the same crypt layer

The encryption is completely transparent — backup schedules, retention policies, and restore workflows all work the same way.

Enabling Encryption

1. Navigate to Settings > S3 Storages in Coolify
2. Click on the storage you want to encrypt
3. In the Encryption section:
   • Toggle Enable Encryption on
   • Enter an encryption password
   • Optionally enter a salt (auto-generated if left blank)
4. Click Save

Password Recovery

There is no way to recover encrypted backups if you lose the encryption password. Store it securely — in a password manager, hardware key, or offline backup. Corelix cannot decrypt your data without the original password.

Configuration Options

Setting	Description	Default
Encryption Password	The master password used for encryption. Required when encryption is enabled.	—
Password Salt	Additional entropy for key derivation. Auto-generated if not provided.	Auto
Filename Encryption	How filenames appear on S3. See options below.	off
Directory Name Encryption	Whether directory names are also encrypted. Only available when filename encryption is enabled.	Off

Filename Encryption Options

Mode	Description	Example on S3
off	Filenames are stored in plain text	backup-2024-06-15.sql.gz
standard	Filenames are fully encrypted	q65210ekol5u9lup1b1n3d4p
obfuscate	Filenames are scrambled but length is preserved	onpxhc-2024-06-15.fdy.tm

When to use filename encryption

Use standard filename encryption when the names of your backup files could reveal sensitive information (database names, dates, etc.). Use off if you need to browse backups on S3 manually. Obfuscate is a middle ground — files are harder to identify but their structure is visible.

Encrypted Restore

When restoring a database from an encrypted S3 backup:

1. Navigate to the database resource
2. Click Import or Restore from S3
3. Select the backup to restore
4. The system automatically detects encryption and decrypts the backup before restoring

No additional steps are needed — the encryption password is stored with the S3 storage configuration.

Compatibility

Encrypted S3 Backups works with any S3-compatible storage provider:

• AWS S3
• MinIO
• Backblaze B2
• DigitalOcean Spaces
• Wasabi
• Cloudflare R2
• Hetzner Object Storage
• Any S3-compatible endpoint

Troubleshooting

Backup fails after enabling encryption

1. Verify the S3 storage credentials are still valid
2. Check that the encryption password is set (not empty)
3. Review the backup job logs in your Coolify dashboard

Cannot restore an encrypted backup

1. Ensure the S3 storage still has the same encryption password that was used when the backup was created
2. If the password was changed after the backup was taken, the old backups cannot be decrypted

Filename encryption prevents S3 browsing

When filename encryption is set to standard, files on S3 have encrypted names and cannot be browsed or identified manually. This is by design. To browse backups, use the Coolify UI or set filename encryption to off or obfuscate.