Configuration

Credentials

Use process variables or an existing --env FILE. Process variables take precedence.

Backblaze B2

B2_KEY_ID=your-key-id
B2_APPLICATION_KEY=your-application-key
B2_BUCKET_NAME=your-bucket
B2_BUCKET_ENDPOINT=https://s3.us-west-004.backblazeb2.com
GLESHA_CATALOG_PASSPHRASE=your-separate-catalog-password

AWS

AWS_ACCESS_KEY_ID=your-access-key
AWS_SECRET_ACCESS_KEY=your-secret-key
AWS_BUCKET_NAME=your-bucket
AWS_REGION=ap-southeast-1
GLESHA_CATALOG_PASSPHRASE=your-separate-catalog-password

Temporary AWS credentials also need AWS_SESSION_TOKEN. The catalog password is separate from archive passwords; a hidden prompt is available instead.

glesha check --to b2 --env /secure/cloud.env
glesha run docs --env /secure/cloud.env

Keep credential files private. Glesha does not rewrite them.

Settings

Nonsecret settings live in the platform user-config directory under glesha/config.toml. CLI flags override TOML defaults.

[archive]
compression = "xz"
compression_level = 6
prefix = "glesha"

[memory]
max = "512MiB"

[aws]
bucket = "my-backups"
region = "ap-southeast-1"
storage_class = "STANDARD"

glesha run docs --config ~/glesha.toml --compression gzip
glesha configure docs --compression xz --compression-level 9
glesha run docs -j 4

-j N allows up to N transfer workers. Memory limits and part count may reduce this. Archiving uses one streaming pipeline; --hash-workers controls hashing separately.

S3 endpoints

Named remotes use the AWS or B2 adapter. Endpoint compatibility depends on the S3 APIs the service implements; AWS cold retrieval is AWS-specific.

[remotes.secondary]
kind = "aws"
bucket = "my-backups"
region = "us-east-1"
endpoint = "https://s3.example.com"

AWS-adapter remotes use AWS credential variable names.

glesha create photos ~/Pictures --to secondary
glesha run photos --env /secure/cloud.env

Passwords and output

glesha run docs --passphrase-file /secure/archive-password \
  --catalog-passphrase-file /secure/catalog-password
glesha status --color=no
glesha run docs --log-level=debug

Passwords are never stored. Keep them: lost passwords cannot be recovered.