From 8ad5b90f881aededd65f3f9affdb1a67c4b7f83b Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Bombeck?= Date: Thu, 10 Sep 2026 00:48:31 +0200 Subject: [PATCH] docs(ops): the off-host worker never prunes; the bucket lifecycle does The runbook said the worker prunes objects older than BACKUP_RETENTION_DAYS. It never calls DeleteObject; its grant is PutObject, GetObject and AbortMultipartUpload, on purpose, so a compromised worker cannot wipe the history. The sentence now says what expires objects and what the variable is for. --- docs/ops/backup-restore.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/docs/ops/backup-restore.md b/docs/ops/backup-restore.md index 92991852b..0ac2d7ad5 100644 --- a/docs/ops/backup-restore.md +++ b/docs/ops/backup-restore.md @@ -54,8 +54,10 @@ Cloudflare R2 the **Object Read & Write** token already covers all three. ## Bucket lifecycle (recommended) -The worker prunes objects older than `BACKUP_RETENTION_DAYS`, but the -storage provider's lifecycle rule is the canonical safety net: +The worker never deletes a backup object: its grant covers PutObject, +GetObject and AbortMultipartUpload only, so a compromised worker cannot +wipe the history. Expiry is the storage provider's lifecycle rule, set to +match `BACKUP_RETENTION_DAYS`: ``` Filter: "" (all objects)