paperless: drop barman SSE-S3 (unsupported by Hetzner) #24

Merged

k.renner merged 1 commits from paperless-hetzner-no-sse into master

2026-06-25 13:26:37 +00:00

Author	SHA1	Message	Date
k.rennerandClaude Opus 4.8	be48843495	paperless: drop barman SSE-S3 (unsupported by Hetzner) The Hetzner cutover broke WAL archiving and base backups with InvalidArgument: barman requests SSE-S3 (encryption: AES256), but Hetzner Object Storage supports only SSE-C, which the barman-cloud plugin cannot use (cnpg plugin-barman-cloud #646). Confirmed live — aws-cli PUT --sse AES256 fails the same way, plain PUT succeeds. Remove encryption from wal/data so backups use no SSE header. Trade-off (accepted): CNPG backups are not encrypted at rest on Hetzner; transit is TLS and the bucket is private. Revisit if/when the plugin gains SSE-C. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-25 15:25:19 +02:00

Author

SHA1

Message

Date

k.rennerandClaude Opus 4.8

be48843495

paperless: drop barman SSE-S3 (unsupported by Hetzner)

The Hetzner cutover broke WAL archiving and base backups with
InvalidArgument: barman requests SSE-S3 (encryption: AES256), but
Hetzner Object Storage supports only SSE-C, which the barman-cloud
plugin cannot use (cnpg plugin-barman-cloud #646). Confirmed live —
aws-cli PUT --sse AES256 fails the same way, plain PUT succeeds.

Remove encryption from wal/data so backups use no SSE header. Trade-off
(accepted): CNPG backups are not encrypted at rest on Hetzner; transit
is TLS and the bucket is private. Revisit if/when the plugin gains SSE-C.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-25 15:25:19 +02:00