Back up to an S3-compatible bucket

Bring-your-own-storage (BYOS) is for people who already have an S3-compatible destination they want to use, or who would rather pay a storage provider directly than pay for a managed tier. You give macup a bucket, macup turns it into an encrypted backup repository, and the bill for the bytes themselves goes to your provider.

What you need before you start

• A bucket name — empty, new, dedicated to macup.
• An access key and secret access key for an IAM user that can read and write that bucket.
• An endpoint URL — provider-specific. For AWS this is implicit; for Backblaze, Wasabi, MinIO, and others, it is an explicit URL.
• A region — the provider’s region code.

Start with an empty bucket. macup creates its repository structure inside; it does not merge with pre-existing data.

Recommended providers

There is no wrong answer here — only trade-offs. Pick based on how much you store, how often you restore, and whether you care more about upfront price or predictable price.

• AWS S3. Highest egress cost of any provider on this list. Best tooling, best durability story, Object Lock compliance mode available. Good if you already live in AWS.
• Wasabi. No egress fees, flat-rate per-terabyte storage, 90-day minimum retention charge — data deleted before 90 days is still billed for 90 days. Fine for backups, which are long-lived; worth noting if you churn snapshots. Object Lock supported.
• Cloudflare R2. No egress fees, pay-per-request and per-GB storage. Object Lock not yet generally available. Good when residency on Cloudflare’s network matters.
• DigitalOcean Spaces. Flat-fee tier (250 GB + 1 TB egress included), predictable monthly bill. Object Lock not available. Good for a fixed small-studio footprint.
• MinIO. Self-hosted S3 on a NAS, homelab, or rack server. You own the hardware, you own the bill, you own the maintenance. Best answer when you already have storage infrastructure and an operator.

Other S3-compatible providers (Storj, IDrive E2, Scaleway, OVH) work; pick by price and residency requirements.

Step 1 — Create the bucket

In your provider’s console, create a new bucket. Enable Object Lock if the provider offers it. Object Lock is the feature that makes your cloud copy immune to ransomware — once written, it cannot be deleted or overwritten until the retention window expires, even if your Mac is fully compromised. Turn it on.

Step 2 — Create a dedicated IAM user

Do not use root credentials. Create an IAM user with a policy that allows read and write on this bucket only — not on your whole account. The exact policy JSON depends on the provider; most publish a “backup-tool IAM policy” template you can paste.

Copy the access key and the secret access key. The secret is shown once.

Step 3 — Add the destination in macup

Open macup > Preferences > Destinations. Click Add destination. Choose Bring your own storage.

Step 4 — Paste the credentials

Fill in:

• Endpoint URL — e.g. https://s3.wasabisys.com or https://<account-id>.r2.cloudflarestorage.com.
• Region — e.g. us-east-1.
• Bucket name.
• Access key.
• Secret access key.

Click Test connection. macup verifies the credentials can read and write the bucket before you commit. If the test fails, the error message tells you which of the five fields is wrong.

Step 5 — Point a backup set at it

Go to Backup Sets, pick the set you want to protect, open Destination, and select the new BYOS destination. First snapshot uploads at your upload speed — there is no magic here, it is bytes over the wire.

The cost model

macup’s BYOS tier is $5/month per device. That pays for the client, the scheduler, the dedup and encryption engine, the restore UI, the status monitoring, and the recoverability guarantees. It does not pay for the storage itself.

Your storage provider bills you directly for storage and (depending on provider) egress. The /backup/cost-calculator models both sides for a given provider and archive size — use it before you commit.

A rough guide for 2 TB of long-lived backup:

• Wasabi — around $13/month storage, zero egress, 90-day retention minimum.
• Cloudflare R2 — around $30/month storage, zero egress, per-request fees on restore.
• AWS S3 Standard — around $47/month storage, egress starts at $0.09/GB.
• MinIO self-hosted — electricity and hardware amortization, typically $0-5/month at the margin.

Add $5 for macup to each line.

Tip — one IAM user per Mac, not per fleet

Do not share a single bucket and a single IAM user across multiple Macs. Create one IAM user per Mac, each scoped to a prefix inside a shared bucket, or better, give each Mac its own bucket. macup structures its repository to scale either way, but scoping credentials per-device means a compromised Mac cannot delete another Mac’s history. It is five extra minutes of setup and a very large improvement in blast radius.