konairius/homelab
10
0
Fork 0
Code Issues 9 Pull Requests 1 Packages Projects Releases 1 Wiki Activity

paperless: drop barman SSE-S3 (unsupported by Hetzner) #24

Merged
k.renner merged 1 commits from paperless-hetzner-no-sse into master 2026-06-25 13:26:37 +00:00
Conversation 0 Commits 1 Files Changed 1
+4 -2
k.renner commented 2026-06-25 13:26:01 +00:00
Owner
Copy Link
Copy Source

Fix: paperless CNPG backups failing on Hetzner

The paperless Hetzner cutover (PR #23) broke WAL archiving + base backups:
InvalidArgument on every PutObject/CreateMultipartUpload. Root cause —
barman requests SSE-S3 (encryption: AES256); Hetzner Object Storage
supports only SSE-C, which the barman-cloud plugin can't use
(cnpg/plugin-barman-cloud#646).
Confirmed live: aws s3 cp --sse AES256 fails identically, plain PUT works.

This removes encryption: AES256 from the pprl-pg ObjectStore (wal+data).

Accepted trade-off: CNPG backups are not encrypted at rest on
Hetzner (transit is TLS, bucket private). Velero is unaffected — Kopia
encrypts client-side. Revisit at-rest encryption if the plugin gains SSE-C.

Current state: paperless ContinuousArchiving=False (WAL queuing on PVC)
until this merges and Flux redeploys. After merge I'll re-validate:
WAL resumes → base backup Completed → scratch restore.

🤖 Generated with Claude Code

## Fix: paperless CNPG backups failing on Hetzner The paperless Hetzner cutover (PR #23) broke WAL archiving + base backups: `InvalidArgument` on every PutObject/CreateMultipartUpload. Root cause — **barman requests SSE-S3 (`encryption: AES256`); Hetzner Object Storage supports only SSE-C**, which the barman-cloud plugin can't use ([cnpg/plugin-barman-cloud#646](https://github.com/cloudnative-pg/plugin-barman-cloud/issues/646)). Confirmed live: `aws s3 cp --sse AES256` fails identically, plain PUT works. This removes `encryption: AES256` from the pprl-pg ObjectStore (wal+data). **Accepted trade-off:** CNPG backups are **not encrypted at rest** on Hetzner (transit is TLS, bucket private). Velero is unaffected — Kopia encrypts client-side. Revisit at-rest encryption if the plugin gains SSE-C. Current state: paperless `ContinuousArchiving=False` (WAL queuing on PVC) until this merges and Flux redeploys. After merge I'll re-validate: WAL resumes → base backup `Completed` → scratch restore. 🤖 Generated with [Claude Code](https://claude.com/claude-code)
k.renner added 1 commit 2026-06-25 13:26:01 +00:00
paperless: drop barman SSE-S3 (unsupported by Hetzner) be48843495 
The Hetzner cutover broke WAL archiving and base backups with
InvalidArgument: barman requests SSE-S3 (encryption: AES256), but
Hetzner Object Storage supports only SSE-C, which the barman-cloud
plugin cannot use (cnpg plugin-barman-cloud #646). Confirmed live —
aws-cli PUT --sse AES256 fails the same way, plain PUT succeeds.

Remove encryption from wal/data so backups use no SSE header. Trade-off
(accepted): CNPG backups are not encrypted at rest on Hetzner; transit
is TLS and the bucket is private. Revisit if/when the plugin gains SSE-C.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
k.renner merged commit 04ec515db8 into master 2026-06-25 13:26:37 +00:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
apollo
Hermes expert: Immich, Audiobookshelf, Libation, Navidrome, Music Assistant
 atlas
Hermes expert: Talos, Flux, network, Authentik, Matrix, monitoring
 clio
Hermes expert: Paperless, wiki, ical-proxy, TRMNL, websites
 daedalus
Hermes expert: Gitea, Woodpecker, Renovate, review-bot, Hermes
 hestia
Hermes expert: Home Assistant, IoT, MQTT, ESPHome, voice
No labels
Milestone
No items
No Milestone
Projects
Clear projects
No projects
Assignees
Clear assignees
alert-monitor-bot claude-bot (Claude Bot) flux hermes-bot issue-fix-bot k.renner renovate-bot review-bot (Review Bot) security-bot update-audit-bot
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: konairius/homelab#24