Configuration

Core settings live in `<base-dir>/config.yml` and define S3 repositories, MariaDB defaults, and encryption behavior.

config.yml Example

config.yml

s3:
  main:
    bucket: "my-backup-bucket"
    region: "eu-west-1"
    access_key: "AKIA..."
    secret_key: "SECRET..."
    endpoint: "https://s3.eu-west-1.amazonaws.com"
    force-path: false
    hostname-immutable: false

mariadb:
  host: "127.0.0.1"
  port: "3306"
  user: "root"
  password: "replace-me"

encryption_key: "replace-me"

S3 Connections

`s3` is a named map. Specs reference these keys using `source: s3:<name>`.

bucket: Target bucket name.
region: Signing region.
endpoint: Optional custom S3 endpoint.
force-path: Path-style requests for compatible providers.
hostname-immutable: Keep endpoint host unchanged.

MariaDB Defaults

`mariadb` config is used by MariaDB drivers in specs. Defaults are applied in code when omitted: host `localhost`, port `3306`, user `root`.

host
port
user
password

Encryption Key Scope

`encryption_key` in `config.yml` is the global fallback. Individual specs can override this with their own `encryption_key`.

For decryption, key precedence is: `--key` flag, then spec key (if spec is provided), then global key.