4 · S3 offsite

Until an S3 remote exists, the Dashboard reminds you: if the appliance is lost, the backups on it are lost with it. Any S3-compatible store works, AWS included; the validation run used a self-hosted MinIO.

4.1 Add a remote

Offsite → Add remote: name, bucket, region, endpoint, credentials. For non-AWS endpoints set the endpoint host(:port) and, typically, path-style on; TLS off only for private lab endpoints. Then Test connection — it verifies write/read/delete against the bucket, not just reachability.

Under Settings → Export & eviction policy you can optionally set the default remote, turn on the IE vault watcher (a host eject auto-exports the cart and returns it to its slot once the upload verifies), and set an eviction pressure threshold.

4.2 Export a cartridge

Library → select the cart → Vault actions → Export now. The export tars the cart deterministically, splits into 10 GB chunks, compresses each with zstd, and uploads with a resumable per-chunk ledger; the manifest lands last as the completion marker. Watch it in Jobs; a ~21 GiB cart uploaded as 1.6 GiB in 3 chunks in about 90 seconds against a local endpoint during validation.

The bucket layout is system / library-serial / cart-label / generation:

<prefix>/demo01/OVTL280164/OVB001L5/20260831T001507Z/{chunk-*.tar.zst, manifest.json}

Repeat exports of the same cart create new generations; the catalog browses all of them.

4.3 Evict to free space

Once a cart has a verified upload, Evict local data becomes available. Eviction re-verifies the bucket copy, then deletes the bulk data locally, leaving a labelled stub. The cart panel then shows a loud EVICTED STUB — NO DATA ON DISK banner with exactly what the host would see if it mounted the stub (a media error; the volume reads as unlabelled *N on the IBM i, and nothing overwrites it) and which generation to import before any restore.

4.4 Import it back

The stub panel’s Import <generation> streams the chunks back, verifies, and rename-swaps into place — the restored cart is byte-identical (validated by checksum on every round trip). Same-day or years later, the flow is the same.

Cancelled or interrupted exports resume from the chunk ledger on Retry — already-uploaded chunks under the same generation are skipped, so leave partial uploads in the bucket. Details and edge cases: runbook §4.