Mastodon

TrueNAS backups on Storm Buckets

TrueNAS sends datasets to S3 storage with a Cloud Sync task, which runs rclone
underneath. Add Storm as a cloud credential, create a task that pushes a
dataset to your bucket on a schedule, and pull it back when you need it.

This page follows TrueNAS 25.10 Community Edition. TrueCloud Backup, the newer
restic-based task, only offers Storj in that release, so Cloud Sync is the
route to Storm.

What you need first

  • A bucket for the backups. See
    Getting Started.

  • A Read / Write key scoped to that bucket. See
    Managing Access Keys.

  • Your bucket's endpoint, from the Connection panel of your bucket page.

Add Storm as a cloud credential

Go to Credentials > Backup Credentials, and in Cloud Credentials click Add.
Pick Amazon S3 as the provider. It is the generic S3 option, and the
fields below point it at Storm.

Field Value
Access Key ID your key ID
Secret Access Key your secret
Endpoint URL your endpoint, for example https://montreal-1.buckets.stormdevelopments.ca
Region montreal-1
Disable Endpoint Region off
Use Signature Version 2 off

Fill in the Region. Left blank, TrueNAS asks the bucket for its location and can
fall back to us-east-1, which fails the signature. There is no path-style
setting to find. TrueNAS hands rclone a generic S3 provider, and rclone uses
path-style for it by default, which is what Storm needs.

Create the Cloud Sync task

Go to Data Protection, and in Cloud Sync Tasks click Add.

  • Credential: the one you just made, then pick your bucket.

  • Direction: PUSH. The form starts on PULL.

  • Transfer Mode: COPY.

  • Source: the dataset you are backing up.

  • Schedule: nightly is a sensible start.

COPY is the mode to use for a backup. SYNC deletes files from the bucket when
they disappear from the dataset, so an accidental delete on the NAS reaches the
backup on the next run, and Storm keeps no earlier versions to roll back to.
MOVE deletes from the dataset after copying.

Run the task once with Dry Run to see what it would send, then run it for
real.

Options worth setting

  • Use Snapshot sends from a ZFS snapshot taken at the start of the run, so
    files changing mid-transfer arrive consistent.

  • Remote Encryption encrypts with rclone before anything leaves the NAS.
    You set an encryption password and salt. Lose either and the backup is
    unreadable, by you and by Storm.     Keep both somewhere that is not the NAS.

  • Bandwidth Limit keeps a first upload from saturating your connection.

Restore

Create a second Cloud Sync task with the same credential and bucket, Direction
PULL, Transfer Mode COPY, and an empty dataset as the destination. Run it once.
If the backup was encrypted, the restore task needs the same password and salt.

For a single file, browse the bucket in the dashboard's
Files and download it. Encrypted backups arrive
with scrambled contents, and only a task with the password can read them.

History

COPY keeps files you deleted on the NAS, but a changed file replaces its copy in
the bucket on the next run. For snapshots you can go back through, back up
with restic instead, from a machine or jail that
can read the dataset.

If a task fails

  • Authentication errors are the region. Check it reads montreal-1, then see
    Troubleshooting.

  • Anything else, send it in from the dashboard with the task's error text.
    A client that fails against Storm is a bug we want to know about.

What this does not cover

  • Storage on Storm is single-zone. Keep a second copy of anything you cannot
    afford to lose, as the Terms of Service say.

Next steps