Guides / PostgreSQLCloudflare R2

Back up PostgreSQL to Cloudflare R2.

Cloudflare R2 is S3-compatible storage with zero egress fees. Here are two ways to get your PostgreSQL data there — the manual command line, and a hands-off, encrypted, verified setup with xbackupman.

The manual way

Dump PostgreSQL to stdout, gzip it, and stream it straight to Cloudflare R2 (no temp file):

pg_dump -h HOST -U USER mydb | gzip | aws s3 cp - s3://BUCKET/postgresql/backup-$(date +%F).sql.gz --endpoint-url https://ACCOUNT.r2.cloudflarestorage.com

This works, but it's the easy 20%. You still own the hard 80%: encryption, scheduling, retention, failure alerts, and proving the backup actually restores. Restore is the reverse: gunzip | psql into an empty database.

The automated way

With xbackupman you connect your PostgreSQL database and your Cloudflare R2 bucket once, pick a schedule, and it handles the rest — AES-256-GCM encryption before upload, SHA-256 verification, retention (including GFS), anomaly detection, and one-click restore. Your backups live in your own Cloudflare R2; we just orchestrate.

  1. 1. Add your PostgreSQL connection (host, port 5432, credentials — encrypted at rest).
  2. 2. Add your Cloudflare R2 bucket as a storage target.
  3. 3. Set a schedule and retention. Done — backups run and verify themselves.

FAQ

Is a plain PostgreSQL dump piped to Cloudflare R2 encrypted?

No. A raw PostgreSQL dump uploaded to Cloudflare R2 is stored as-is — anyone with bucket access can read it. xbackupman encrypts every backup with AES-256-GCM inside the worker before upload, so only ciphertext ever reaches Cloudflare R2.

How do I know the backup will actually restore?

The manual command gives you no guarantee. xbackupman records a SHA-256 checksum and can re-download, decrypt and decompress the backup to prove it's restorable before you ever need it.

Can I schedule this and prune old copies automatically?

The command above is one-shot. xbackupman runs it on any cron schedule (down to minutes), applies simple or grandfather-father-son retention, and alerts you if a backup fails or looks anomalous.