Integration & CLI Configuration Guide

1. Standard AWS S3 CLI & Object Lock Setup

Configure a named profile in ~/.aws/config pointing to your regional ingest endpoint, then create an Object-Lock-enabled bucket with a 30-day compliance retention rule:

[profile nordic]
region = eu-north-1
endpoint_url = https://nordicdatasync.com
s3 =
    signature_version = s3v4
    max_concurrent_requests = 16
    multipart_threshold = 64MB
    multipart_chunksize = 16MB

aws --profile nordic s3api create-bucket \
  --bucket prod-ledger-immutable \
  --object-lock-enabled-for-bucket

aws --profile nordic s3api put-object-lock-configuration \
  --bucket prod-ledger-immutable \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": { "DefaultRetention": { "Mode": "COMPLIANCE", "Days": 30 } }
  }'

2. PostgreSQL Continuous PITR with pgBackRest

Stream compressed 16 MB WAL segments directly from PostgreSQL 14–17 primaries to Stockholm (`ARN-1`) with sub-second archive command latency:

[global]
repo1-type=s3
repo1-s3-endpoint=nordicdatasync.com
repo1-s3-bucket=pg-prod-cluster-01
repo1-s3-region=eu-north-1
repo1-s3-uri-style=path
repo1-path=/pgbackrest
repo1-retention-full=4
repo1-retention-diff=14
repo1-cipher-type=aes-256-cbc
compress-type=zst
compress-level=6
process-max=8

[main]
pg1-path=/var/lib/postgresql/17/main

Verify continuous WAL archiving and take a non-blocking online full backup:

sudo -u postgres pgbackrest --stanza=main check
sudo -u postgres pgbackrest --stanza=main --type=full backup

3. Deduplicated Encrypted Filesystem Snapshots (Restic)

Initialize a client-side encrypted Restic repository and schedule hourly systemd snapshots with automatic pruning:

export AWS_ACCESS_KEY_ID="NDS_AKIA_PROD_EXAMPLE"
export AWS_SECRET_ACCESS_KEY="nds_secret_key_material"
export RESTIC_REPOSITORY="s3:https://nordicdatasync.com/srv-snapshots-01"
export RESTIC_PASSWORD_FILE="/etc/restic/repo.key"

restic init
restic backup /var/vmail /etc /srv/docker-volumes --exclude-caches -o s3.connections=16
restic forget --keep-hourly 24 --keep-daily 14 --keep-monthly 12 --prune

4. Kubernetes Cluster Disaster Recovery (Velero)

Protect persistent volumes and cluster manifests across namespaces using the standard AWS Velero plugin:

velero install \
  --provider aws \
  --plugins velero/velero-plugin-for-aws:v1.10.0 \
  --bucket k8s-prod-etcd-backups \
  --secret-file ./credentials-nordic \
  --backup-location-config region=eu-north-1,s3ForcePathStyle="true",s3Url=https://nordicdatasync.com