Re: Bacula backup using S3 cloud storage says 'Volume "ICHSI-0012" is unavailable now'

Yes, I have been using volume encryption the entire time. I'm able to 
successfully use the key-manager.py tool on the command line with "sudo 
-u bacula" to retrieve my volume keys.

Below are my cloud configs. These haven't changed in 9 months while this 
has been working. The only changes really are running a system update 
and upgrading packages. The bacula packages were recompiled on OpenSUSE 
Leap 16.0 (via OpenSUSE Build Service) and were part of the package 
upgrade. Previously they were using the 15.6 compiled packages. I 
upgraded to 16.0 last week. In order for dependencies to work on 16.0, I 
needed to create a conf file for sysusers.d for creation of system 
users, and also update the "Provides" for user() and group(). Not sure 
why that would effect how bacula-sd functions though. All the user/group 
permissions on files and processes are still fine.

-Tom

Autochanger {
   Name = CloudChanger1
   Device = CloudStorage1-1, CloudStorage1-2
   Changer Device = /dev/null
   Changer Command = ""
}

Device {
   Name = CloudStorage1-1
   Media Type = File1
   Device Type = Cloud
   Cloud = DOSpaces
   Archive Device = /var/spool/cloud
   LabelMedia = Yes
   Enabled = Yes
   Autochanger = Yes
   Random Access = Yes
   AutomaticMount = Yes
   Removable Media = no
   AlwaysOpen = No
   Maximum Concurrent Jobs = 5
   Maximum Part Size = 512MB
   Volume Encryption = Yes
}

Device {
   Name = CloudStorage1-2
   Media Type = File1
   Device Type = Cloud
   Cloud = DOSpaces
   Archive Device = /var/spool/cloud
   LabelMedia = Yes
   Enabled = Yes
   Autochanger = Yes
   Random Access = Yes
   AutomaticMount = Yes
   Removable Media = No
   AlwaysOpen = no
   Maximum Concurrent Jobs = 5
   Maximum Part Size = 512MB
   Volume Encryption = Yes
}

Cloud {
   Name = DOSpaces
   Description = "DigitalOcean Spaces - ichaos-backup-cold"
   Driver = S3
   Host Name = sfo3.digitaloceanspaces.com
   Blob Endpoint = "https://sfo3.digitaloceanspaces.com/"
   Bucket Name = ichaos-backup-cold
   Access Key = "XXXX"
   Secret Key = "YYYY"
   Protocol = HTTPS
   UriStyle = Path
   Truncate Cache = No
   Upload = AtEndOfJob
   #MaximumUploadBandwidth = 2MB/s
}

On 8/6/2026 11:51 PM, Rob Gerber wrote:
> A quick note before I go to bed: bacula 15.x provides a new feature: 
> volume encryption. This volume encryption does what it sounds like it 
> does - encrypts volumes. This is different from the fd encryption 
> introduced in older versions of bacula, where the fd controls whether 
> data is encrypted. (Bacula 15.x continues to support fd encryption, of 
> course). The new volume encryption is controlled by the sd.
>
> Check your sd 'drive' devices. Do any of them have encryption enabled? 
> See my sample device in my prior email for an example of that directive.
>
> It is not mandatory to use volume encryption. You should understand 
> how the key files are stored, and separately back them up. Without the 
> key files, you will be unable to restore your data. Bacula generates a 
> new key for each volume labeled. I am not aware of any master key 
> provision in the volume encryption scheme (maybe someone can correct 
> me here, if I am mistaken).
>
> Re: amazon driver: I am curious as to whether it would work correctly 
> if the problem volume was set to 'used' or something, or another 
> volume was otherwise provided. Would the amazon driver configuration 
> you installed then function correctly, proving that it is functional?
>
> Robert Gerber
> 402-237-8692
> [email protected]
>
> On Thu, Aug 6, 2026, 11:56 PM Thomas Ruth via Bacula-users 
> <[email protected]> wrote:
>
>     Thanks for your response. I've installed the awscli tool and
>     switched the config to use the Amazon driver. I've also added the
>     BlobEndpoint configuration item. I reloaded the config and that
>     didn't work. Then I stopped the jobs, restarted bacula-sd, then
>     resumed the jobs, and that didn't work. Finally I started the job
>     fresh and I get the same result as before.
>
>     I looked through the source code. There is a section starting with
>     "switch (vol_label_status)" in src/stored/mount.c and the path I'm
>     running into is part of this:
>     case VOL_ENC_ERROR:
>
>     Is this an encryption problem? I installed updates recently,
>     perhaps openssl updated and broke something?
>
>     -Tom
>
>     On 8/6/2026 9:42 PM, Rob Gerber wrote:
>>     I don't know what could be causing this, but I can say that my
>>     understanding is that the S3 driver is somewhat prone to causing
>>     issues. For bacula 15.x+, it is recommended that one use the
>>     Amazon driver instead. Despite the name, the driver does work
>>     with other providers besides amazon. IIRC, heaps of providers are
>>     supported. The biggest caveat that I ran into was that my Cloud
>>     {} resource needed an additional variable because I (like you),
>>     am using a non-AWS cloud storage provider. Because of this, I had
>>     to specify a BlobEndpoint value. I believe without the
>>     BlobEndpoint value, the Amazon driver assumes the files are
>>     located at an AWS URL and attempts to access the buckets at
>>     AWS. I think the BlobEndpoint directive informs bacula that it
>>     must abandon this behavior of assuming an AWS URL, and also tells
>>     bacula which URL to use to find the volume. Why it cannot do this
>>     from the hostname, I do not know.
>>
>>     See my bacula-sd.conf snippets, for an example.
>>
>>     Cloud {
>>       Name = "B2-TD-Diff"
>>       Driver = "Amazon"
>>       HostName = "s3.us-west-004.backblazeb2.com
>>     <http://s3.us-west-004.backblazeb2.com>"
>>       BlobEndpoint = "https://s3.us-west-004.backblazeb2.com/"
>>       BucketName = "TD-Bacula-Diff"
>>       AccessKey = "123REDACTED"
>>       SecretKey = "456REDACTED"
>>       Protocol = "HTTPS"
>>       UriStyle = "VirtualHost"
>>       TruncateCache = "AfterUpload"
>>       Upload = "No"
>>     }
>>     Autochanger {
>>       Name = "B2-TD-Diff"
>>       Device = "B2-TD-Diff-001"
>>       Device = "B2-TD-Diff-002"
>>       Device = "B2-TD-Diff-003"
>>       Device = "B2-TD-Diff-004"
>>       Device = "B2-TD-Diff-005"
>>       Device = "B2-TD-Diff-006"
>>       ChangerDevice = "/dev/null"
>>       ChangerCommand = "/dev/null"
>>     }
>>     Device {
>>       Name = "B2-TD-Diff-001"
>>       Description = "B2-TD-Diff"
>>       MediaType = "B2-TD-Diff"
>>       DeviceType = "Cloud"
>>       ArchiveDevice = "/mnt/synology/bacula/B2-TD-Diff"
>>       RemovableMedia = no
>>       RandomAccess = yes
>>       AutomaticMount = yes
>>       LabelMedia = yes
>>       Autochanger = yes
>>       ReadOnly = no
>>       MaximumFileSize = 5368709120
>>       MaximumConcurrentJobs = 1
>>       DriveIndex = 0
>>       MaximumPartSize = 5368709120
>>       Cloud = "B2-TD-Diff"
>>       VolumeEncryption = yes
>>     }
>>
>>     Hopefully this helps.
>>
>>     Regards,
>>     Robert Gerber
>>     402-237-8692
>>     [email protected]
>>
>>

_______________________________________________
Bacula-users mailing list
[email protected]
https://lists.sourceforge.net/lists/listinfo/bacula-users