Event Photos Backed Up to S3
Point Galeira at your own S3 bucket — AWS, Cloudflare R2, Backblaze B2, or Wasabi — and approved event photos mirror to a per-event prefix. Every upload returns a signed backup receipt with object key, ETag, byte count, and timestamp so you can audit what landed.
- ✓Works with AWS S3, Cloudflare R2, Backblaze B2, Wasabi
- ✓You own the bucket, the bill, and the access key
- ✓Signed receipt per object: key, ETag, bytes, timestamp
- ✓Per-event prefix keeps each gathering isolated
- ✓Encrypted-at-rest credentials, scoped to PutObject
- ✓Revoke the key anytime — backup stops cleanly
Who picks S3 for event backup
S3-compatible storage is the destination of choice for technical hosts who already run cloud infrastructure, agencies that bill clients for storage as a line item, and venues that need every gathering to land in a single audited account. If you have an AWS or Cloudflare console open most days, mirroring approved event photos into a bucket you already manage is less friction than learning a new vendor portal. Galeira treats your bucket as the canonical archive and itself as the capture and moderation layer in front of it. The host journey stays the same — guests scan a QR, upload from the phone they already hold, moderation runs — and every approved photo writes through to your bucket with a per-event prefix. You keep the IAM policy, the lifecycle rules, the region choice, and the bill. Galeira keeps the receipts.
- ✓Technical hosts who already maintain cloud accounts
- ✓Agencies that pass storage costs through to clients
- ✓Venues consolidating every event into one bucket
- ✓Teams with compliance rules tied to a specific region
- ✓Hosts who want lifecycle rules and cold-tier control
How Galeira authenticates to your bucket
You create an IAM user (or R2/B2/Wasabi equivalent) scoped to a single bucket and a single prefix, generate an access key and secret, and paste both into the event's backup settings. Galeira encrypts the secret at rest before it touches a database row and decrypts only inside the worker that performs the upload. The minimum policy Galeira needs is PutObject on the prefix you choose — no ListBucket, no GetObject, no DeleteObject. That means even if the key leaked, the worst-case blast radius is writes into your own prefix, not a read of everything you already store. You can rotate the key on your normal schedule; paste the new one and the old one stops being used on the next upload. Revoke the key in your provider console and the backup channel closes cleanly, with the event continuing to function on Galeira itself.
- ✓Scope the IAM policy to PutObject on one prefix
- ✓Access key + secret stored encrypted at rest
- ✓Decryption only inside the upload worker
- ✓Rotate keys on your normal cadence
- ✓Revoke at the provider to stop backup instantly
Bucket layout and the verify marker
Galeira writes a predictable layout into the prefix you choose so your archive stays browsable in any S3 client. The root of the prefix gets a small marker file named .galeira-verify that proves the credentials work and labels the bucket as the destination for a specific event. Under the prefix, each approved photo lands at events/{event-id}/{photo-id}.{ext} alongside a sidecar JSON with the moderation timestamp, uploader handle, and content hash. If you back up several events into the same bucket, each one gets its own event-id directory, so deleting a single gathering is a single prefix delete on your side. The layout is designed to be readable by humans, scriptable by rclone or aws s3 sync, and stable enough that you can point a static site or a long-term archive process at it without coordination with Galeira.
- ✓Marker file .galeira-verify confirms credentials work
- ✓Per-event prefix isolates each gathering
- ✓Sidecar JSON records moderation + uploader metadata
- ✓Compatible with rclone, aws s3 sync, and S3 browsers
- ✓Stable paths safe to point archive jobs at
S3 vs R2, B2, and Wasabi — same protocol, different prices
The S3 API is now a protocol, not a single product. AWS S3 itself remains the default for teams already inside the AWS console and for hosts who need a specific region, lifecycle integration with Glacier, or tight IAM coupling to other AWS services. Cloudflare R2 is attractive when egress matters — guests viewing the gallery, or your team pulling the archive back later — because R2 doesn't charge for egress on the public internet. Backblaze B2 is the budget pick for cold-ish long-term storage, with a simple per-GB price and predictable egress. Wasabi takes the same shape with no egress fees up to a monthly cap. Galeira speaks the same protocol to all four; the only fields that change in the backup settings are the endpoint URL, the region string, and the bucket name. Pick the provider that matches how you want to pay, and Galeira mirrors approved photos there.
- ✓AWS S3: native lifecycle to Glacier, region control
- ✓Cloudflare R2: zero egress to the public internet
- ✓Backblaze B2: simple per-GB pricing for cold archive
- ✓Wasabi: flat storage price, no egress up to a cap
- ✓Same access key + secret + endpoint shape everywhere
Lifecycle rules and cold storage for the long archive
Once approved photos land in your bucket, the lifecycle policy is yours to set. A common pattern for event hosts is to keep everything in standard storage for the first thirty to ninety days while guests are still actively viewing the gallery, then transition objects to a cold tier — Glacier Instant Retrieval on AWS, archive class on B2, or simply a cheaper bucket on R2 — for long-term retention. Galeira doesn't manage that transition; it writes once and steps back. That means lifecycle, replication across regions, object-lock for legal hold, and any compliance-grade retention windows are configured in your provider console with rules you already trust. If you later need to restore a photo from a cold tier, the path is unchanged: the object key in the receipt is the same key your restore job targets. Galeira's receipts stay valid regardless of which storage class the object currently lives in.
- ✓Standard tier while the gallery is hot
- ✓Transition to Glacier / archive class for cold years
- ✓Object-lock and replication stay in your control
- ✓Receipts reference the stable object key, not the tier
- ✓Restores from cold tier need no Galeira coordination
Back up originals to a cloud you already own.
Galeira stores the event gallery so guests can view and download it, but the important part is ownership. When you connect a cloud destination, approved originals mirror to a place you control: Google Drive, Dropbox, OneDrive, S3, or WebDAV. The backup-status page shows what copied, what is pending, and what needs attention.
External cloud-provider outages and account deletions are outside Galeira's control — which is exactly why the receipt matters. You can verify, retry, and export while your archive is active.
How Galeira compares to the methods people try
Each method gets photos somewhere. The differences are in friction, quality, privacy, and what you can recover afterward.
Questions hosts ask before they create the QR
Which S3-compatible providers does Galeira support?
AWS S3, Cloudflare R2, Backblaze B2, and Wasabi are tested destinations. Any provider that implements the S3 PutObject API with standard signature v4 should work; you supply the endpoint URL, region string, bucket name, access key, and secret.
What IAM permissions does Galeira need on my bucket?
PutObject on the prefix you choose, and that's it. You do not need to grant ListBucket, GetObject, or DeleteObject — Galeira writes through and never reads back, which keeps the credential blast radius narrow.
How are my access key and secret stored?
Both are encrypted at rest before they hit a database row and decrypted only inside the upload worker that talks to your bucket. They are not exposed in the host dashboard after entry and are never written to logs.
What is the .galeira-verify marker file?
It's a small JSON marker Galeira writes to your prefix the first time it authenticates successfully. It confirms the credentials work, labels the prefix as belonging to a specific event, and gives you a file to look for in your S3 client to verify setup.
Can I back up several events into the same bucket?
Yes. Each event gets its own event-id directory under the prefix you choose, so multiple gatherings stay isolated inside one bucket. Deleting a single event later is a single prefix delete on your side.
Does Galeira manage lifecycle rules or cold storage?
No, and that's deliberate. Lifecycle transitions to Glacier, archive tiers on B2, object-lock, and cross-region replication are configured in your provider console with rules you already trust. Galeira writes once and steps back.
What happens if I rotate or revoke the key?
Rotate by pasting the new key — the old one stops being used on the next upload. Revoke at the provider and the backup channel closes cleanly while the event itself keeps functioning on Galeira.
Can I verify each backup landed correctly?
Yes. Every upload returns a signed receipt with the object key, ETag, byte count, and timestamp, which you can match against the object metadata in your S3 client or via a HEAD request.
Do guests upload directly to my bucket, or through Galeira first?
Through Galeira first. Capture, moderation, and the gallery view all run on Galeira, and only approved photos mirror to your bucket. That keeps the moderation queue out of your archive.
What region should I pick for the bucket?
Pick the region closest to where your guests and your team live, subject to any compliance requirements you have. Galeira honours whatever region the endpoint URL points at and does not move objects between regions on its own.
Keep reading
Create your event QR in about 60 seconds
Guests scan, upload, and view the gallery. You keep full-resolution originals backed up to your own cloud.