Cloudflare R2

Store backups in Cloudflare R2 with zero egress fees.

Overview

Cloudflare R2 is an S3-compatible object storage with a unique pricing model:

• ✅ Zero egress fees - Download as much as you want
• ✅ S3-compatible API
• ✅ Global distribution via Cloudflare network
• ✅ Automatic geographic distribution

Configuration

Field	Description	Example
Name	Friendly name	R2 Backups
Account ID	Cloudflare Account ID	a1b2c3d4...
Bucket	R2 bucket name	backups
Access Key ID	R2 API token key	Required
Secret Access Key	R2 API token secret	Required
Path Prefix	Folder within bucket	/db-backups

Cloudflare Setup

Create R2 Bucket

1. Login to Cloudflare Dashboard
2. Go to R2 in sidebar
3. Click Create bucket
4. Enter bucket name
5. Click Create bucket

Create API Token

1. In R2 section, click Manage R2 API Tokens
2. Click Create API token
3. Configure permissions:
   • Object Read & Write for your bucket
4. Copy the Access Key ID and Secret Access Key

Save Credentials

The Secret Access Key is only shown once. Save it securely!

Find Account ID

Your Account ID is in the URL when logged into Cloudflare:

https://dash.cloudflare.com/YOUR_ACCOUNT_ID/...

Or find it in the R2 overview page.

Configuration Example

Account ID: abc123def456
Bucket: my-backups
Access Key ID: xxxxxxxxxxxxxxxx
Secret Access Key: xxxxxxxxxxxxxxxxxxxxxxxx
Path Prefix: /production

DBackup automatically constructs the endpoint:

https://abc123def456.r2.cloudflarestorage.com

Cost Comparison

R2 vs S3

Operation	R2	S3 Standard
Storage	$0.015/GB/mo	$0.023/GB/mo
Class A (write)	$4.50/million	$5.00/million
Class B (read)	$0.36/million	$0.40/million
Egress	$0	$0.09/GB

When R2 Saves Money

R2 is cheaper when you:

• Download backups frequently
• Restore databases often
• Use Storage Explorer heavily
• Transfer between regions

Features

Automatic Distribution

R2 automatically replicates data globally. No region selection needed.

S3 Compatibility

Works with any S3-compatible tool:

• AWS CLI
• rclone
• Cyberduck

Bucket Lifecycle (Coming)

Cloudflare is adding lifecycle rules for automatic transitions.

Limitations

No Storage Classes

Unlike S3, R2 has a single storage tier. No Glacier equivalent.

Regional Considerations

R2 stores data globally but may have compliance implications:

• Check if global distribution meets your requirements
• Consider for non-sensitive data

Integration with Cloudflare

Workers Integration

Access backups via Cloudflare Workers for custom processing:

// Worker example
export default {
  async fetch(request, env) {
    const object = await env.MY_BUCKET.get("backup.sql");
    return new Response(object.body);
  }
}

Custom Domain

Serve backups via custom domain:

1. Go to R2 bucket settings
2. Add custom domain
3. Access via https://backups.example.com/file.sql

Troubleshooting

Invalid Account ID

Invalid accountId

Solutions:

1. Copy Account ID from Cloudflare dashboard
2. Remove any spaces
3. Verify format (alphanumeric)

Access Denied

AccessDenied

Solutions:

1. Verify API token has read/write permissions
2. Check token is for the correct bucket
3. Regenerate API token if needed

Bucket Not Found

NoSuchBucket

Solutions:

1. Verify bucket name (case-sensitive)
2. Create bucket in R2 dashboard
3. Check Account ID is correct

Security

API Token Best Practices

1. Create dedicated token for DBackup
2. Limit to specific bucket
3. Use Object Read & Write only
4. Rotate tokens periodically

Encryption

Enable DBackup encryption for sensitive data:

• R2 encrypts at rest automatically
• DBackup adds client-side encryption
• Zero-knowledge: Cloudflare can't read your data

Migration from S3

Using rclone

rclone copy s3:my-bucket r2:my-r2-bucket --progress

Update DBackup

1. Create R2 destination in DBackup
2. Update jobs to use new destination
3. Verify backups work
4. Remove old S3 destination

Next Steps

• Enable Encryption
• Configure Retention
• Storage Explorer