TitanVault: Scheduled, encrypted backups to object storage
Backs up PostgreSQL databases and directories as zstd-compressed archives, optionally encrypted on the host with ChaCha20-Poly1305, to Hetzner Object Storage, Cloudflare R2, any S3-compatible bucket or a local path. Cron schedules, GFS retention and a terminal UI.
[schedule] cron = "0 2 * * *" [crypto] enabled = true passphrase = "a-long-random-passphrase" [[sources.databases]] name = "app-postgres" driver = "postgres" container_name = "postgres" database = "app" user = "postgres" [[sources.filesystems]] name = "app-configs" paths = ["/opt/stack"] excludes = ["**/data/**"] [targets.cloudflare_r2] endpoint = "https://<account_id>.r2.cloudflarestorage.com" bucket = "prod-backups" access_key = "..." secret_key = "..."
What it does
One job: get scheduled, compressed and optionally encrypted copies of your databases and files into storage you control.
No temporary files
Dumps and archives are compressed, encrypted and uploaded without writing temporary files to disk. The whole archive is held in memory during a run, so size the host for your largest source.
Encryption before upload
With encryption enabled, archives are encrypted on your server before they leave it, so the storage provider only sees ciphertext. Off by default; keep your passphrase safe.
Terminal UI
Review sources, targets and retention, test storage connectivity, list snapshots and run a backup from the terminal, without an account.
GFS retention
Five schedule levels (hourly, daily, weekly, monthly and yearly), each with its own cron. After a successful run, old snapshots are pruned per source and level.
Four steps, one binary
What happens on every scheduled or on-demand backup. Read the code on GitHub.
Dump
Runs pg_dump on the host or inside your container with docker exec, or builds a tar of the configured paths, skipping excludes.
Compress
Compresses the archive in memory with zstd. No temporary files are written to disk.
Encrypt
Optionally encrypts it with ChaCha20-Poly1305 and a random nonce per archive, before anything leaves the host.
Upload and prune
Writes the archive to every enabled target through Apache OpenDAL, then applies GFS retention. A heartbeat URL can be pinged on success.
How it compares
TitanVault does less than the established backup tools. Pick it when you want scheduled dumps to object storage that you can also manage from SecuryBlack.
| Capability | TitanVault | Cron + shell script | restic / BorgBackup |
|---|---|---|---|
| Restore | To a new path (files or SQL export), from the CLI or the SecuryBlack panel | Whatever you write | Built-in restore command |
| Deduplication | No, a full archive per run | No | Yes |
| PostgreSQL dumps | Built in (pg_dump, also via docker exec) | Whatever you write | Pipe pg_dump through stdin |
| Retention | GFS per source and level | Whatever you write | Built-in keep policies |
| SecuryBlack panel | Through nexus-agent (config, backups, heartbeats) | No | No |