Destinations
A destination is a restic repository URL entered on a job; Vecta does not provide a separate destination-management screen.
Choose a destination
| Type | URL format | Setup asks for | Port | Good fit |
|---|---|---|---|---|
| S3-compatible | s3:https://<endpoint>/<bucket> |
Access key ID and secret access key | None | AWS S3, Cloudflare R2, Wasabi, MinIO, and compatible services |
| Backblaze B2 | b2:<bucket>:<path> |
Account ID and application key | None | A Backblaze B2 bucket |
| SFTP | sftp:<user>@<host>:<path> |
SSH key authentication only | Optional, default 22 | An SSH-accessible host |
| Local path | /path/to/repo |
Nothing | None | A repository on the same machine as the agent |
For example, a Cloudflare R2 repository uses s3:https://<account>.r2.cloudflarestorage.com/<bucket>. Replace the placeholders with your account endpoint and bucket name. Follow the restic documentation for provider-specific URL details.
Configure the destination
After creating the job, configure its destination on the agent machine:
sudo vecta-agent setup <JOB_ID>
Replace <JOB_ID> with the job ID from the dashboard. S3-compatible setup prompts, with hidden
input, for an access key ID and secret access key. B2 setup prompts, also with hidden input, for an
account ID and application key. Local paths and SFTP destinations do not require destination
credential prompts, but a new repository still receives a generated repository password.
If credentials for the destination are already stored on the agent, setup skips the credential
prompts. If the repository does not exist, setup initializes it and prints the generated password
once. You must type SAVED before setup continues; store the password in a password manager first.
Warning
SFTP supports SSH keys only. Password authentication is not supported. Authorize the agent user's public key on the destination host and set the correct host, path, and optional port in the job.
For SFTP, setup validates the destination format and probes the SSH sftp subsystem with key
authentication, without asking for a password. If the probe fails, it prints copyable
ssh-keygen, ssh-copy-id, and sftp commands to help correct the key setup. A non-default SSH
port comes from the job's port field.
Credential storage
Credentials are stored on the agent per destination string. Jobs with the same destination share one stored credential set. The agent resolves credentials in this order: machine environment, ~/.config/vecta/restic.env, then stored per-destination credentials. Stored credentials win when present.
The credentials file is ~/.config/vecta/credentials.toml and must have mode 600. Local paths, SFTP with authorized SSH keys, instance roles, and pre-set environment credentials can work without stored credentials.
Changing a destination
Changing the destination changes the string used to find credentials. Re-run setup after saving the job, or the next backup can fail authentication.
Note
The destination URL itself, including its bucket, host, or path, is stored as job metadata in the control plane. Credentials and repository passwords are not. See Zero-access security.
What's next
Create a job with Jobs, or read Restoring Data before your first production backup.