Customer-owned archive destinations
Choose local files, S3, Azure Blob or Google Cloud Storage in your infrastructure.
Configure and test storage
Provision the bucket or container separately. Adding a destination saves configuration without connecting. destination test writes, verifies and removes a unique probe. Supported source databases can use one sink, with separate policies and job namespaces. Set the referenced credentials through your environment or secret manager; values are not stored in configuration.
coldctl destination add s3 --name aws-archive --bucket YOUR_BUCKET --region ap-south-1 --prefix coldctl
coldctl destination test aws-archive
coldctl destination add azure --name azure-archive --account YOUR_ACCOUNT --container archives --prefix coldctl
coldctl destination test azure-archiveCredential choices
S3 defaults to AWS_ACCESS_KEY_ID and AWS_SECRET_ACCESS_KEY. Temporary static credentials also require --session-token-env AWS_SESSION_TOKEN; this mode does not renew them automatically. Azure defaults to AZURE_STORAGE_ACCOUNT_KEY. Use --role-auth or --managed-identity for automatic cloud credential refresh on supported deployments, as described in Cloud storage authentication.
Durability and local disk
The provider-independent sink interface uses create-only publication and full-object checksum verification. Keep the local state and staging directory on durable storage; pending batches are needed after interruption. --staging-path selects a local directory. Publication is bounded to 128 MiB per object, with batch-level retry rather than multipart resume. Allow adequate disk for pending staging and verified reads.
Emulators and endpoints
Custom HTTPS S3-compatible and Azure endpoints use environment credentials. HTTP requires --allow-http and an explicit loopback endpoint. Cloud identity modes reject all custom endpoints and HTTP. Azurite uses an account-path endpoint; provision fixture storage first.
coldctl destination add s3 --name moto --bucket coldctl-test --region us-east-1 --endpoint http://127.0.0.1:19000 --allow-http
coldctl destination add azure --name azurite --account coldctltest --container coldctl-test --endpoint http://127.0.0.1:11000/coldctltest --allow-httpVerification, restore and removal
Jobs retain their selected destination configuration for verification, restore and verified source deletion. Downloaded standalone archives are treated as local files; embedded destination settings do not authorize remote access. Removing a destination removes configuration, not archive objects. Keep backups of local state alongside protected remote objects.
Google Cloud Storage
GCS supports archive publication, verification, restore, Gateway retrieval and recurring deletion with automatic shadow gates. Use Google credentials through local environment references.