How to automate PrintStash backups to S3

PrintStash can mirror each full backup to AWS S3, Cloudflare R2, Backblaze B2, MinIO, or another S3-compatible service. It always writes the archive locally first, then uploads the same file to the configured bucket.

The application creates backups on demand. If you want a nightly job, schedule the API call from cron, a NAS task runner, or the automation tool you already use.

What a backup contains

A full archive contains:

• a transactionally consistent SQLite database snapshot;
• model and G-code files owned by PrintStash;
• generated thumbnails;
• a manifest with the backup ID, version, and timestamp.

The built-in backup and restore flow does not support PostgreSQL. Use pg_dump and your normal PostgreSQL restore procedure, then protect managed local or S3 objects separately.

Files indexed in place from a NAS or other shared volume are not copied into the archive. Keep backing up that folder with restic, Borg, snapshots, or the NAS tool you already trust.

Configure the backup bucket

Set the backup-specific variables in .env:

VAULT_BACKUP_S3_BUCKET=printstash-backups
VAULT_BACKUP_S3_ENDPOINT_URL=https://<account-id>.r2.cloudflarestorage.com
VAULT_BACKUP_S3_REGION=auto
VAULT_BACKUP_S3_ACCESS_KEY=<access-key>
VAULT_BACKUP_S3_SECRET_KEY=<secret-key>
VAULT_BACKUP_RETENTION_DAYS=30

AWS S3 normally uses its regional endpoint and region instead. MinIO and B2 need their own endpoint. Create the bucket first and give the credentials permission to read, write, list, and delete objects in that bucket.

Restart the stack after changing environment values:

docker compose up -d

Create one backup manually from Settings -> Storage and confirm that it appears both in the local backup directory and in the bucket. Fix this before adding a schedule.

Schedule the backup call

The backup API requires a superuser. Create a named API key on the superuser account used by the job, or create a dedicated superuser if you want its credentials and audit trail separated. Treat that key as highly privileged. At run time, exchange the username and key for an access token, then call POST /api/v1/backups. The API automation guide explains that login flow.

A daily cron entry can call your wrapper script at 03:20, for example:

20 3 * * * /opt/printstash/bin/run-backup

Make the wrapper fail on HTTP errors and send its output somewhere you will notice. A scheduled command that fails quietly is not an automated backup.

Test the restore path

Download an archive from the UI, restore it into a scratch PrintStash stack, and check a known model, its files, tags, and print history. Restoring replaces the current database and owned files; it does not merge two libraries.

S3 protects against losing the PrintStash host. It does not prove that the archive is usable. A periodic test restore is the part that turns an uploaded object into a recovery plan.