# Connect your tools in 60 seconds > Step-by-step setup of Zaryn storage in rclone, restic, Kopia, Veeam, Synology Hyper Backup and Cloud Sync, aws-cli and any S3 tool. Three settings, copy, paste, done. Source: https://zaryn.xyz/docs/en/connect-storage Every tool on this page talks to Zaryn the same way it talks to Amazon S3. You give it three things, and it works. ```diagram type: cards title: The three settings every tool asks for --- 🌐 | Endpoint | s3.zaryn.xyz (some tools want https:// in front) | accent 🔑 | Access key + secret | From Storage → S3 access → Create key. The secret is shown once | 📍 | Region | zaryn. A tool that insists on us-east-1 works too | good ``` Two more answers, for tools that ask: **signature version 4**, and **path style** (virtual-hosted style works too). ```diagram type: flow title: The same path for every tool --- Key | Make an S3 key on the Storage page, one per tool or machine | accent | 🔑 ~ Bucket | Make a bucket on the page, or let the tool make it | | 🪣 ~ Settings | Endpoint, key, region in the tool | | 🔧 ~ First run | Back up or sync once, then read a file back | | ✓ ``` ## Before you start: a key and a bucket 1. Open [Storage → S3 access](/storage#s3), write what the key is for (*nas*, *veeam*, *laptop*) and press **Create key**. 2. Copy the access key (it starts with `ZK`) and the secret. The secret is shown only once. 3. Make a bucket on the same panel with **Make bucket**, or let the tool make it. Bucket names are lowercase letters, digits and dashes, like `nas-backup`. Names are shared by everyone, so pick one that's yours. A key per tool means you can revoke one machine without touching the others. ## rclone rclone copies and syncs folders, and mounts a bucket as a drive. ```bash rclone config create zaryn s3 provider=Other endpoint=https://s3.zaryn.xyz region=zaryn \ access_key_id=ZK... secret_access_key=... rclone mkdir zaryn:my-files rclone sync ~/Documents zaryn:my-files/documents --progress rclone check ~/Documents zaryn:my-files/documents ``` `rclone check` compares every file with what's stored. To use the bucket like a folder: `rclone mount zaryn:my-files ~/zaryn`. ## restic restic makes encrypted, deduplicated snapshots. ```bash export AWS_ACCESS_KEY_ID=ZK... export AWS_SECRET_ACCESS_KEY=... export RESTIC_REPOSITORY=s3:https://s3.zaryn.xyz/restic-backups restic init restic backup ~/Documents restic snapshots restic restore latest --target ~/restored ``` Keep the restic password somewhere safe: without it nobody, Zaryn included, can read the backup. ## Kopia Kopia makes encrypted snapshots and has a desktop app (KopiaUI). ```bash kopia repository create s3 --bucket=kopia-backups --endpoint=s3.zaryn.xyz --region=zaryn \ --access-key=ZK... --secret-access-key=... kopia snapshot create ~/Documents kopia snapshot list kopia restore ~/restored ``` In **KopiaUI**: *Repository → Amazon S3 or compatible storage*. Bucket `kopia-backups`, server endpoint `s3.zaryn.xyz`, region `zaryn`, then the access key and the secret. Leave *Use HTTP connection (insecure)* off. ## Veeam Veeam Backup & Replication, and Veeam Agent for Windows and Linux, use Zaryn as an S3-compatible object storage repository. ```diagram type: flow title: Veeam Backup & Replication --- Add repository | Backup Infrastructure → Backup Repositories → Add → Object storage → S3 Compatible | accent | ➕ ~ Account | Service point https://s3.zaryn.xyz, data center region zaryn, credentials: your key and secret | | 🔑 ~ Bucket | Browse → pick the bucket → a folder for Veeam | | 🪣 ~ Use it | Point a backup job or a Scale-out repository's capacity tier at it | | ✓ ``` 1. **Backup Infrastructure → Backup Repositories → Add Repository → Object storage → S3 Compatible.** 2. Name it (*Zaryn*). **Service point:** `https://s3.zaryn.xyz`. **Data center region:** `zaryn`. **Credentials:** *Add*, then the access key and the secret. 3. **Bucket:** *Browse* and pick the bucket (Veeam doesn't make buckets: make it on the Storage page). **Folder:** *Browse → New Folder* (*veeam*). 4. Leave **Make recent backups immutable** off: Veeam's immutability needs S3 versioning, which Zaryn doesn't offer. Protect the bucket on Zaryn's side instead (below). 5. Finish, then point a backup job (or the capacity tier of a Scale-out backup repository) at it. **Veeam Agent** (Windows or Linux): in the job, choose *Object storage → S3 Compatible* and give the same service point, region, key, bucket and folder. ## Synology NAS **Hyper Backup** (versioned backups of the NAS): 1. *Create → Data backup task → S3 Storage*. 2. **S3 Server:** *Custom Server URL*, then `s3.zaryn.xyz`. 3. **Signature version:** *v4*. **Request style:** *Path style*. Turn **HTTPS** on. 4. **Access key** and **Secret key**: yours. **Bucket name:** pick it from the list. 5. Choose the folders, then a schedule and **Enable backup rotation** to keep a set number of versions. **Cloud Sync** (a folder kept in step with a bucket): *+ → S3 Storage → Custom Server URL `s3.zaryn.xyz`, Signature v4, Path style*, the key, the secret and the bucket, then the local folder and the direction (both ways, upload only, download only). QNAP's HBS 3 and TrueNAS's Cloud Sync tasks work the same way: choose *S3 compatible*, then the endpoint, region, key and bucket. ## aws-cli ```bash aws configure --profile zaryn aws configure set region zaryn --profile zaryn aws configure set endpoint_url https://s3.zaryn.xyz --profile zaryn aws s3 mb s3://my-files --profile zaryn aws s3 sync ~/Pictures s3://my-files/pictures --profile zaryn aws s3 ls s3://my-files/pictures/ --profile zaryn ``` `aws configure` asks for the access key and the secret; leave the output format empty. With `endpoint_url` in the profile, no command needs `--endpoint-url` again. ## Any other tool Cyberduck, Mountain Duck, MinIO's `mc`, Duplicati, Arq, Duplicacy, an SDK in your code: if it has an *S3 compatible* or *custom endpoint* option, it works. | Setting | Value | |---|---| | Endpoint, server, service point | `s3.zaryn.xyz` or `https://s3.zaryn.xyz` | | Region | `zaryn` (`us-east-1` works too) | | Access key, secret | from [Storage → S3 access](/storage#s3) | | Signature | version 4 | | Addressing | path style (virtual-hosted works too) | | Biggest object | 5 GB; bigger files go in parts (multipart), which tools do on their own | ## Protect what you've connected A backup tool holds a key that can delete. If ransomware gets to the machine, it gets the key too. Give the bucket a protection the key can't remove: ```diagram type: cards title: Pick one for a backup bucket --- 🗑 | Trash, 14 days | Deletes and overwrites go to the trash; put the bucket back as it was at any moment | accent 🔒 | Lock, governance | Nothing deleted before its time; lowering the lock waits 3 days and emails you | ⛓ | Lock, compliance | Nobody can delete before its time, not even you | good ``` For Veeam, Hyper Backup, rclone and Kopia, choose the **trash**: they delete their own old versions, and a lock would refuse those deletes. A bucket made on the Storage page has a 14-day trash already; change it in [Storage → S3 → a bucket → Protection](/storage#s3). How each one works: [Ransomware protection](/docs/en/ransomware-protection). ## If it doesn't connect | What you see | What to do | |---|---| | `SignatureDoesNotMatch` | The secret is wrong or has a space at the end. Copy it again, or make a new key. | | `RequestTimeTooSkewed` | The computer's clock is more than 15 minutes off. Turn on automatic time. | | `InvalidAccessKeyId` | The key was revoked, or the access key and the secret are swapped. | | `NoSuchBucket` | Make the bucket first, or check its name: lowercase only. | | `QuotaExceeded` | Your [storage plan](/storage#plans) is full. What's stored is untouched; reads and deletes still work. | | A certificate error | Use `s3.zaryn.xyz`, with *https* on. Virtual-hosted style needs the bucket name to be a plain name, no dots. | | Veeam: *immutability is not supported* | Turn **Make recent backups immutable** off and use the bucket's trash. | ## What you get with every tool - **Counted once.** The same bytes stored twice (a second copy, the same photo in two folders) count once on your [plan](/storage#plans). - **Checked on every read.** Each object is named by its hash and checked before a byte is sent. A damaged copy is never served. - **Proved every day.** A signed [daily receipt](/docs/en/verified-storage#your-whole-account-a-receipt-every-day) lists what you have stored. Check it yourself with `zev verify-receipt`. Prefer one command for everything? [`zev backup`](/docs/en/backups) makes the key and the bucket, encrypts, schedules and protects. Related: [S3-compatible storage](/docs/en/s3-storage), [Backup with zev backup](/docs/en/backups), [Ransomware protection](/docs/en/ransomware-protection).