From be48843495b78ab91094347417c4721278add92c Mon Sep 17 00:00:00 2001 From: Konstantin Renner Date: Thu, 25 Jun 2026 15:25:19 +0200 Subject: [PATCH] paperless: drop barman SSE-S3 (unsupported by Hetzner) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Hetzner cutover broke WAL archiving and base backups with InvalidArgument: barman requests SSE-S3 (encryption: AES256), but Hetzner Object Storage supports only SSE-C, which the barman-cloud plugin cannot use (cnpg plugin-barman-cloud #646). Confirmed live — aws-cli PUT --sse AES256 fails the same way, plain PUT succeeds. Remove encryption from wal/data so backups use no SSE header. Trade-off (accepted): CNPG backups are not encrypted at rest on Hetzner; transit is TLS and the bucket is private. Revisit if/when the plugin gains SSE-C. Co-Authored-By: Claude Opus 4.8 (1M context) --- kubernetes/seed/paperless/objectstore.yaml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/kubernetes/seed/paperless/objectstore.yaml b/kubernetes/seed/paperless/objectstore.yaml index f8921c72..ed646335 100644 --- a/kubernetes/seed/paperless/objectstore.yaml +++ b/kubernetes/seed/paperless/objectstore.yaml @@ -21,10 +21,12 @@ spec: region: name: hetzner-s3-creds key: REGION + # No `encryption: AES256` (SSE-S3): Hetzner Object Storage supports + # only SSE-C, which the barman-cloud plugin can't use (cnpg + # plugin-barman-cloud #646). At-rest encryption is therefore not + # available here; transit is TLS and the bucket is private. wal: compression: gzip - encryption: AES256 data: compression: gzip - encryption: AES256 retentionPolicy: "30d" -- 2.54.0