Provider guide

Back Up a Mac to Cloudflare R2

Cloudflare R2 exposes an S3-compatible API, so Azivault can store encrypted backup repository objects in an R2 bucket.

When this setup makes sense

Users who already use Cloudflare or want object storage with an account-scoped S3 endpoint.

What to enter in Azivault

In Azivault, choose Create New Plan, select the source folder, then go to Storage. Set Destination type to S3 compatible.

• Bucket name: the bucket dedicated to the Azivault repository.
• Region: Cloudflare documents the S3 API region as auto. If a tool requires a region, Cloudflare notes that an empty value or us-east-1 can alias to auto.
• Custom endpoint: Use Cloudflare's account endpoint format: https://<ACCOUNT_ID>.r2.cloudflarestorage.com.
• Use path-style requests: Azivault turns this on by default when a custom endpoint is present, unless you manually change the toggle.
• Access key ID and secret access key: Create R2 API tokens or access keys scoped to the bucket and keep them with your recovery notes.
• Session token: optional. Use it only if the provider issued one for the credentials.

Setup checklist

1. Create an R2 bucket in the Cloudflare dashboard.
2. Create an R2 access key pair with the permissions Azivault needs.
3. Enter the bucket, endpoint, region value, access key, and secret in Azivault.
4. Use Test, then run a small first backup and restore check.
5. Click Test in Azivault and wait for a healthy result before adding the plan.
6. Finish the schedule and recovery password steps, then add the plan.

What the storage test verifies

Azivault's S3 test is a real read/write check. It writes a small object under .azivault-health-check/, confirms the object exists, lists that prefix, reads the object back, and deletes it. If the test fails, review the bucket, region, endpoint URL, credentials, path-style setting, and network access.

Restore and disaster recovery

Existing backups remain restorable even if a subscription expires, but you still need the repository data, provider access, and the Azivault recovery password or synced Keychain key. For S3-compatible storage, plan how you would hydrate or copy the remote repository objects to a local folder, then import that repository folder into Azivault for restore browsing.

Cloudflare R2 backup risks

• Object lock support: R2's S3 compatibility page lists implemented and unimplemented APIs separately, so do not assume AWS S3 Object Lock behavior exists for your bucket. If immutability is required, verify the current R2 feature set before relying on it.
• Lifecycle rules: R2 lifecycle configuration is useful for storage hygiene, but backup repositories depend on older objects remaining readable. Avoid expiration rules that delete repository objects before your restore policy says they are no longer needed.
• Egress costs: Cloudflare currently lists R2 internet egress as free, while operations and some storage-class retrievals remain billable. A restore drill should include Class B reads and any infrequent-access retrieval costs, not just bandwidth.
• Regional durability: R2 uses an account endpoint and auto region for S3 clients. That simplifies configuration, but you should still document whether your data placement and jurisdiction choices meet your recovery and compliance needs.
• Access key scope: Create R2 credentials scoped to the target bucket and store the token details separately from the Mac. Account-wide credentials increase blast radius if they are copied from a backup configuration.
• Restore gotchas: Use the account S3 endpoint and region auto during recovery. A public custom domain for object delivery is not a replacement for the S3-compatible endpoint Azivault needs.

Provider notes

• Use the S3-compatible endpoint, not a public custom domain for the bucket.
• R2's S3 compatibility does not mean every optional AWS S3 feature is implemented. Azivault only needs ordinary private object storage operations.

Provider details can change. Check Cloudflare R2 S3 API docs before creating a production backup plan.

See also S3-compatible backup for macOS, offsite backup for macOS, and how to restore files from an Azivault backup.

FAQs

Can Azivault back up to Cloudflare R2?

Yes. Azivault can use Cloudflare R2 as an S3-compatible backup destination with the bucket, region, endpoint, and access credentials described on this page.

Are files encrypted before they reach the provider?

Yes. Azivault encrypts repository contents locally before repository objects are written to folder or S3-compatible destinations.

What does Azivault's S3 test button check?

For S3-compatible destinations, Azivault writes a small health-check object, confirms it exists, lists the health-check prefix, reads it back, and deletes it.

How do I recover if the original Mac is gone?

Keep the provider account, storage credentials, and Azivault recovery password available. For remote S3-compatible repositories, hydrate or copy the repository objects to a local repository folder before importing it into Azivault.