Agentrails
GitHub
← Agentrails

Connection verification available now

Your bucket. Your encrypted archive.

Link now. Transfer later.

The desktop app can save an OS-protected credential and verify an S3-compatible bucket you own today. Encrypted archive upload and clean-device restore remain disabled until their recovery and reliability gates pass.

Connection

Four steps, once.

Keep the bucket private and scope access to Agentrails only.
  1. 01

    Choose your storage

    Select R2, AWS S3, B2, Wasabi, MinIO, or another provider from rclone's catalog. Keep the bucket private.

  2. 02

    Create a scoped token

    Grant object read, write, list, and delete only for the bucket and prefix Agentrails will use.

  3. 03

    Connect in the desktop app

    Enter the provider, bucket details, and keys through the native Agentrails form. Secrets stay protected by the operating system.

  4. 04

    Verify the connection

    Agentrails uploads a random 64 KiB probe, checks its size, downloads and compares it, then deletes it. The connection is saved only if every step succeeds.

Integration references:rclone S3 providers ↗·rclone RC API ↗

Credentials

Set up your provider.

Create a dedicated key for one private bucket. Save the secret when it appears—it is usually shown only once.
Cloudflare R2Object token
  1. Create or select a private R2 bucket.
  2. Open R2 Overview → Account Details → API Tokens and create anObject Read & Write token scoped to that bucket.
  3. Copy the Access Key ID, Secret Access Key, Account ID, and jurisdiction. Agentrails uses region auto.
Official R2 instructions ↗
Amazon S3IAM access key
  1. Create a private bucket and keep Block Public Access enabled.
  2. Create a dedicated IAM user without console access and attach a bucket-and-prefix policy for list, read, write, and delete.
  3. Under Security credentials, create an access key and copy both values. Never use root access keys.
Official IAM instructions ↗
Backblaze B2Application key
  1. Create or select a private bucket and copy its S3 endpoint.
  2. Open Application Keys, add a key limited to that bucket, and choose Read and Write. Avoid the master key.
  3. Use keyID as Access Key ID andapplicationKey as Secret Access Key.
Official B2 instructions ↗
WasabiProgrammatic sub-user
  1. Create a private bucket and record its regional service URL.
  2. Create a restricted policy, then create a sub-user with Programmatic access and attach that policy.
  3. Generate keys and enter them with the bucket Region and endpoint.
Official Wasabi instructions ↗
DigitalOcean SpacesLimited access key
  1. Create or select a private Space and note its region.
  2. Open Spaces Object Storage → Access Keys, choose Limited access, select the Space, and grant Read/Write/Delete.
  3. Copy the keys and use endpoint<region>.digitaloceanspaces.com.
Official Spaces instructions ↗
MinIOChild access key
  1. Create a private bucket and identify the HTTPS S3 API endpoint.
  2. Attach a bucket-scoped policy to a dedicated user, then create a child key with mc admin accesskey create.
  3. Enter the generated keys, endpoint, and configured MinIO Region. The Console URL may be different from the S3 API URL.
Official MinIO instructions ↗

Agentrails shows the exact field mapping, provider-specific guidance, and prefix-scoped permissions inside the current desktop setup flow.

What you enter

Provider
Selected from rclone's catalog
Bucket
Your selected bucket
Region
When required by the provider
Endpoint
Derived from a known provider preset
Object prefix
Dedicated, such as agentrails/
Access Key ID
From the scoped token
Secret Access Key
Stored with OS-protected encryption

Known-provider presets keep ordinary setup simple. Custom endpoints are an explicit advanced option with strict HTTPS, credential, URL, and private-network protections.

What works now

Random probe→Your bucket→Read back→Delete
  • The verification object contains random bytes only—not transcript content.
  • The desktop main process controls rclone through a private, authenticated RC connection.
  • Probe bytes and remote length must match before the connection is saved.
  • Failed probes are cleaned up, and credentials fail closed when protected operating-system storage is unavailable.

Planned transfer keeps object names free of thread titles, source paths, and provider names. Restore will verify checksums and decryption before rebuilding the local index.

Security boundary

Private by architecture.

No public bucket, browser upload, or Agentrails cloud account is required. Connection secrets are protected now. Archive transfer will support one writer device initially and stays disabled until recovery keys, encrypted manifests, durable retries, and clean-device restore tests are complete.