Skip to content
More support
Contact us
  • There are no suggestions because the search field is empty.

How to use Impossible Cloud Storage as a Kloset store in Plakar

Connect the open-source Plakar backup engine to Impossible Cloud Storage for encrypted, deduplicated snapshots of your servers, databases, and container workloads.

 Plakar is an open-source backup tool that creates versioned snapshots with client-side encryption, compression, and deduplication. Snapshots are written to a Kloset store, which this guide hosts in an Impossible Cloud Storage bucket. 

This guide was tested with Plakar v1.1.4. Plakar documents this integration on their side as well - see the Plakar Impossible Cloud integration page and the Plakar S3 integration documentation, which covers the full set of connector options.

Prerequisites

  • Plakar v1.1.4 or higher installed on the machine that will run the backups. See the Plakar installation guide.
  • A bucket in Impossible Cloud Storage. If you have not created one yet, see Creating a bucket. If you intend to use Object Lock, read the immutability section at the end of this article first - Object Lock can only be enabled at bucket creation.
  • An IAM user with programmatic access and an access key/secret key pair. Follow the secure programmatic access guide if you have not done this yet. Plakar publishes the set of S3 actions it uses in the Plakar Control Plane S3 documentation, which is a useful starting point when writing a least-privilege policy for a standard versioned bucket.

Step 1: Install the Plakar S3 package

The S3 connectors ship as a separate package. Install it and confirm it is present:

$ plakar pkg add s3 
$ plakar pkg list

Pre-built packages require Plakar authentication. If plakar pkg add fails with an authentication error, see Logging in to Plakar. You can also build the package from source with plakar pkg build s3.

Step 2: Note your regional endpoint

Plakar addresses the bucket through the regional S3 endpoint of Impossible Cloud Storage, for example eu-central-2.storage.impossibleapi.net. You can find the endpoint for your bucket under the Buckets tab in the Storage Console, or in the Impossible Cloud endpoint reference.

Impossible Cloud Storage accepts both addressing styles that Plakar supports:

  • Path-style, the Plakar default: s3://eu-central-2.storage.impossibleapi.net/my-backup-bucket
  • Virtual-hosted-style: s3://my-backup-bucket.eu-central-2.storage.impossibleapi.net, combined with the option virtual_host=true

The examples below use path-style. Do not include https:// in the location value; use the use_tls=true option instead.

Step 3: Register Impossible Cloud Storage as a Plakar store

A store connector saves the endpoint and credentials under an alias, so later commands can reference it as @name. Register your bucket:

$ plakar store add impossible-cloud \   location=s3://eu-central-2.storage.impossibleapi.net/my-backup-bucket \   access_key=<YOUR_ACCESS_KEY_ID> \   secret_access_key=<YOUR_SECRET_ACCESS_KEY> \   use_tls=true

Replace the endpoint, bucket name, and keys with your own values. Keep use_tls=true: Impossible Cloud Storage does not accept unencrypted HTTP connections. Do not set tls_insecure_no_verify - our endpoints present valid public certificates, and disabling verification exposes the connection to interception. The complete list of store options is documented in the Plakar S3 integration documentation.

Step 4: Initialise the Kloset store

Creating the store writes the Kloset structure into the bucket and sets the encryption passphrase:

$ plakar at @impossible-cloud create

Plakar prompts for a passphrase. This passphrase protects your data and is not stored anywhere by Plakar or by Impossible Cloud. If it is lost, the snapshots in the bucket cannot be recovered. Store it in your password manager or secret manager before continuing. For unattended runs, see the Plakar guide on retrieving secrets via an external command.

Step 5: Run a backup

Point Plakar at the store and give it a source path:

$ plakar at @impossible-cloud backup /var/www

The first run transfers all unique chunks; subsequent runs only transfer what changed. The same store can hold snapshots from multiple sources. Plakar also supports non-filesystem sources such as PostgreSQL, MySQL, Kubernetes, Proxmox, and S3 buckets - see the Plakar integrations list.

Step 6: Verify the snapshot

List the snapshots in the store and check their integrity:

$ plakar at @impossible-cloud ls $ plakar at @impossible-cloud check

To browse snapshot contents in a browser, run plakar at @impossible-cloud ui.

Making backups immutable with Object Lock

Impossible Cloud Storage supports S3 Object Lock, which prevents objects from being overwritten or deleted for a defined retention period. Combined with Plakar's client-side encryption, this means an attacker who obtains your access keys can neither read nor destroy existing snapshots.

Plakar currently supports buckets where the lock is applied across the whole bucket, rather than per object. In Impossible Cloud Storage this corresponds to an aggregate retention policy defined at bucket creation.

To set this up, create a new bucket with Enable Versioning and Enable Object Lock both selected, and define the retention mode and validity in the same dialog. Object Lock cannot be added to an existing bucket, so plan this before you initialise the Kloset store. For retention modes, legal holds, and the rules on changing retention afterwards, see Using object lock.

Choose a retention period that matches your snapshot retention policy. Locked object versions cannot be removed before their retention expires, so a period longer than intended will keep superseded chunks in the bucket after plakar prune and maintenance would otherwise have removed them.