Use rclone with encryption.

1. Prepare the S3 remote

Install rclone from its official installation guide. The following setup must wait for a working ArcaCipher endpoint and issued credentials.

rclone config

Create a remote named arca-s3, select s3 storage, and use the provider/settings confirmed by ArcaCipher. Enter the supplied access key, secret, HTTPS endpoint and region. Do not invent a hostname or use AWS defaults without confirmation.

In S3 paths, ARCA_S3_ID below means the exact bucket identifier supplied for your Arca, not its display name. Connection addressing and permissions still need service validation.

2. Add client-side encryption

Run rclone config again. Create a remote called arca-private of type crypt, pointing at arca-s3:ARCA_S3_ID/rclone-private after replacing the identifier. Choose standard filename encryption and directory-name encryption. Generate a strong encryption password and retain it, along with any second password/salt and the configuration, securely offline.

Upload through arca-private: to encrypt content locally. Uploading directly through arca-s3: bypasses crypt. rclone’s stored password obscuring is not strong protection for the configuration file; restrict access and consider configuration encryption. Loss of the crypt secrets means loss of recovery.

3. Trial a small copy

These examples use a local ./backup-test folder and a dedicated remote trial directory. Replace local paths as needed. First inspect the dry run, then run the copy.

rclone copy ./backup-test arca-private:trial --dry-run
rclone copy ./backup-test arca-private:trial --progress

copy does not delete extra destination files, but it can replace changed files at the same path. This is not a versioned backup. Use separate dated destinations or a backup tool with retention when you need older recovery points. Avoid sync for this first trial: it can delete destination files.

4. Verify and restore

With the source unchanged, check the encrypted copy and restore into a new, empty local folder:

rclone cryptcheck ./backup-test arca-private:trial
rclone copy arca-private:trial ./restore-test --progress

Check both commands’ results and open the restored files. If the backend cannot provide the hashes required by cryptcheck, download and compare the restored files locally; do not treat an unsupported check as a pass. Schedule only after a successful recovery trial, and review failures and storage use.

Connection and recovery checks

For access errors, check the supplied endpoint, region, identifier, credentials and device clock. Do not disable certificate validation. A crypt password mismatch can make existing data unreadable; do not overwrite it while investigating. Keep secrets out of command history and shared logs.

Official references: S3 setup, crypt and its limits, copy and cryptcheck. See also the backup checklist.