Guides / Hetzner
Back up Hetzner PostgreSQL to Backblaze B2
Set up automatic, scheduled PostgreSQL backups from Hetzner into your own Backblaze B2 bucket — with retention, optional encryption and failure alerts — without writing a script or maintaining a cron server.
Why back up off-platform?
Hetzner server snapshots are whole-disk images: slow to restore, not point-in-time consistent for a database, and stored in the same account.
B2 is roughly a quarter of the price of S3 and speaks the S3 API. Ideal if you want lots of history.
Step 1 — Find your Hetzner database credentials
On your Hetzner Cloud server, allow the Dumpling worker IP in the Hetzner firewall (and pg_hba.conf / MySQL bind address). Create a read-only backup user.
Then allow the Dumpling worker's static IP address 2.28.121.200 to connect. Enable SSL if your server supports it. For extra safety, create a read-only user; the exact GRANT statements are in the docs.
Step 2 — Create a Backblaze B2 bucket and access key
- Buckets → Create a Bucket (private).
- Application Keys → Add a New Application Key restricted to that bucket with read/write access.
- Note the
keyID(Access Key ID),applicationKey(Secret) and the S3 endpoint shown on the bucket, e.g.https://s3.us-west-004.backblazeb2.com.
In Dumpling, the endpoint is https://s3.us-west-004.backblazeb2.com and the region is us-west-004. B2 storage is $6/TB-month and the first 3× your stored volume in egress each month is free.
Step 3 — Create the backup job
- Sign in (free, no card) and add the database from step 1. Dumpling tests the connection and reports the version and size immediately.
- Add the Backblaze B2 bucket from step 2. Dumpling writes and deletes a tiny test object to confirm the key works.
- Create a job: pick a schedule (daily at 02:00 UTC is a good default), how many backups to keep, and optionally a passphrase to encrypt files client-side-decryptably.
The first backup starts right away. From then on, Dumpling runs pg_dump on schedule and streams the output straight into B2. Every run shows the object key, size, duration and log.
Restoring
Download the object from Backblaze B2 and run:
createdb restored_db pg_restore --no-owner --no-acl -d restored_db 2026-09-10T02-00-01Z.dump
Encrypted files (.enc) decrypt with openssl enc -d -aes-256-cbc -pbkdf2; see the restore docs.
Prefer to do it yourself?
It is a few lines of shell — the hard part is the machine to run it, retention, and knowing when it silently stops working:
# DIY alternative: a cron job on a server you maintain 0 2 * * * PGPASSWORD=... pg_dump -Fc -h HOST -U USER DB \ | aws s3 cp - s3://BUCKET/backups/$(date -u +%FT%TZ).dump --endpoint-url https://s3.us-west-004.backblazeb2.com # ...plus retention, alerting, and a machine to run it on.
Dumpling exists so you do not have to babysit that cron job. The free plan covers one database with daily backups forever.