feat: native AWS S3 backup target (alongside Vercel Blob)#15
Open
triebdev wants to merge 13 commits into
Open
Conversation
Declare @aws-sdk/client-s3, @aws-sdk/lib-storage and @aws-sdk/s3-request-presigner as optional peer dependencies (and dev dependencies for the build/tests). They are loaded lazily only when the S3 target is used, so Vercel-only installs are unaffected.
Introduce BackupStorageAdapter plus the object/ref/validation types describing the operations the plugin performs on backup archives (list, put, del, read, stream, validate). This is the seam both the Vercel Blob and S3 targets implement.
Add BACKUP_STORAGE selector (vercel-blob default, s3 opt-in) and BACKUP_S3_* parsing with sensible defaults (region, forcePathStyle when an endpoint is set, optional key prefix, AWS default-credential-chain fallback). Includes getBackupStorageKind, isS3Configured, loadS3Config.
Wrap the existing @vercel/blob helpers behind the new adapter interface without changing behaviour, so the historical default target keeps working exactly as before.
Implement the S3 target with multipart upload, paginated list, presigned downloads and key-prefix support. The AWS SDK is imported dynamically so it stays optional. The same implementation serves any S3-compatible store (Cloudflare R2, MinIO) — only the endpoint/forcePathStyle config differs.
resolveBackupStorage builds the adapter for the active target; isBackupStorageConfigured lets endpoints return 503 early (Vercel needs a token, S3 needs a bucket). Re-export the public storage surface.
…apter listBackups and createBackup (archive upload + cron pruning) now go through the resolved adapter instead of calling @vercel/blob directly. The Vercel path is unchanged; the S3 path is selected via config. Media bundling still reads the Payload upload store as before.
…wnload via adapter Replace the Vercel-token 503/access gates with isBackupStorageConfigured so the S3 target passes, and route delete/download through the adapter. Restore works for S3 via the presigned download URL.
…ntrols for S3 Expose the active target (and a non-secret S3 summary) from the settings endpoint, show a Storage pill on the dashboard, and add a Storage target section to the settings modal. When S3 is active the Vercel-only dedicated-token section is hidden and the dashboard lists S3 backups. Target selection stays config-driven (BACKUP_STORAGE).
Unit-test config resolution (selector precedence, defaults, credential fallbacks) and the S3 adapter (multipart put, paginated list mapping, presigned URL, prefix round-trip, delete, validate) by mocking the AWS SDK the same way existing suites mock @vercel/blob.
Add a 'Choosing a backup target' README section with AWS and R2 examples, document the new env vars in dev/.env.example, ignore real .env files (keeping .example templates tracked), and add the changeset.
|
Review the following changes in direct dependencies. Learn more about Socket for GitHub.
|
Remove the seedDemoDumpUrl option, admin/seed endpoint, and restoreSeedMedia helper. Update README to reflect Vercel Blob + S3 target support, clarify storage configuration in settings, and remove seed-related API documentation. Adjust backup/restore to route media I/O through the storage adapter instead of direct Vercel Blob calls.
Contributor
Coverage ReportCoverage after merging
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds AWS S3 as a selectable backup target next to the existing Vercel Blob.
The S3 implementation also covers any S3-compatible store (Cloudflare R2, MinIO)
with no provider-specific code — only configuration differs. Vercel Blob remains the
default, so existing deployments are unaffected.
What changed
src/core/storage/): a provider-agnosticBackupStorageAdapterinterface, env-based config + target selector, a
VercelBlobStorageadapter (wraps theexisting
@vercel/blobcalls unchanged), anS3BackupStorageadapter (multipart upload,paginated list, presigned downloads, optional key prefix), and a factory/resolver.
target-aware (
isBackupStorageConfigured) so the S3 path passes. Restore on S3 works viathe presigned download URL. The Vercel path is behaviorally unchanged.
Storagepill and the settings modal shows the activetarget (with a non-secret S3 summary). When S3 is active, the Vercel-only "dedicated token"
section is hidden.
dev/.env.exampleupdated, AWS SDK added as optional peer deps (loaded lazily; Vercel-onlyinstalls unaffected), and tests for the S3 adapter + config resolution.
Configuration
Select the target with
BACKUP_STORAGE(vercel-blobdefault, ors3). For S3:BACKUP_S3_BUCKETBACKUP_S3_REGIONAWS_REGION, thenus-east-1BACKUP_S3_ENDPOINTBACKUP_S3_FORCE_PATH_STYLEtruewhen an endpoint is setBACKUP_S3_PREFIXBACKUP_S3_ACCESS_KEY_ID/BACKUP_S3_SECRET_ACCESS_KEY/BACKUP_S3_SESSION_TOKENS3 credentials are env-only (no UI field), keeping secrets out of the database.
Backward compatibility
No breaking changes. With
BACKUP_STORAGEunset, behavior is identical to before (Vercel Blobvia
BLOB_READ_WRITE_TOKEN, including the optional dedicated-token override in admin settings).Testing
download / restore / delete).