Enderchest documentation
Enderchest is S3-compatible object storage for backups, archives and media libraries. This guide covers setup, client configuration and the supported S3 operations.
Overview
You create buckets, put objects in them, and read them back over the S3 API or from the web console. Every object is encrypted with its own key before it is stored, and every read is verified against the checksum taken at upload.
Limits
| Item | Limit |
|---|---|
| Maximum object size | 5 TB (via multipart upload) |
| Maximum single-request upload | 5 GB; larger objects must use multipart |
| Multipart part size | 5 MB to 5 GB, up to 10,000 parts |
| Bucket names | 3 to 63 characters: lowercase letters, digits and dashes; unique within your account |
| Object keys | Up to 1024 bytes of UTF-8; / acts as a folder separator in listings |
| Buckets and access keys per account | Unlimited |
| Stored capacity | 50 GB free, then $3 per TB per month. See pricing |
Quick start (console)
- Create an account and sign in. You land in the console at
/app. - Click New bucket, give it a name such as
backups, and open it. - Drag files onto the page, or click Upload. Large files upload in parallel parts and resume if the connection drops.
- Click a file to see its details, download it, or copy a share link.
- Open Access keys in the console to create credentials for your tools, then follow the section for your client below.
Folders in the console are prefixes: a file uploaded into photos/2026/ has the key photos/2026/name.jpg. There is no separate folder object.
Access keys
Tools authenticate with an access key ID and a secret access key, exactly as with S3. Create them in the console under Access keys.
- Scope: read-write keys can create, upload, list and delete. Read-only keys can list and download only, which is right for media players and mirrors.
- The secret is shown once, at creation. Store it in your tool's config or a password manager. If it is lost, revoke the key and create a new one.
- Keys belong to your account and see all of your buckets. Revoking a key takes effect immediately.
- Give each tool or machine its own key so you can revoke one without touching the others.
Endpoint and region
| Setting | Value |
|---|---|
| Endpoint | https://s3.enderchest.store |
| Region | eu-ams-1. Requests signed with any other region name are also accepted |
| Location | Data is stored in Amsterdam, Netherlands; the gateway runs in Helsinki, Finland |
| Addressing | Path-style: https://s3.enderchest.store/bucket/key |
| Signature | AWS Signature Version 4, header or presigned query |
| TLS | Required in production; use the https:// endpoint |
Most clients call this "provider: Other", "custom endpoint" or "S3-compatible". Path-style addressing must be enabled: bucket names go in the path, not in the hostname. Every example below sets it.
Clients and tools
Each client has its own page with the exact settings and the everyday commands. All of them use the endpoint and region above with path-style addressing.
- rclone: copy, sync, mount and check from any machine.
- restic: encrypted, deduplicated backups with retention.
- AWS CLI: the aws s3 commands with one extra flag.
- s3cmd and MinIO client: two more command-line clients.
- boto3 (Python): Python scripts and services.
- Kopia: encrypted snapshots with a desktop app.
- Duplicati: scheduled backups from a web interface.
- Pterodactyl: game server backups straight from the panel.
- Synology Hyper Backup: a Synology NAS, no extra software.
- TrueNAS: Cloud Sync tasks from TrueNAS SCALE.
- Proxmox Backup Server: VM and container backups offsite.
- WordPress (UpdraftPlus): site backups with UpdraftPlus.
Share links
A share link is a download URL for one file that works without an account. Create one from the file's detail panel in the console, choose how long it stays valid (up to 30 days), and send it.
- The link grants read access to that one file only. It cannot be used to list or reach anything else.
- Links expire at the time you chose. An expired link returns an error rather than the file.
- To revoke a link early, delete the file or upload a new version over it; existing links stop working.
- Range requests work over share links, so a video link seeks normally in a browser or player.
If you need programmatic links, use S3 presigned URLs from your client (see the boto3 example); those are signed with your access key and can also be revoked by revoking the key.
Large files and multipart uploads
Objects above a few hundred megabytes should be uploaded in parts. Every listed client does this automatically; the console does it for anything larger than 64 MB.
- Parts are 5 MB to 5 GB each, up to 10,000 parts, for a maximum object of 5 TB.
- Each part is durable the moment its upload returns. If the connection drops, only the part in flight is lost.
- The console remembers unfinished uploads in your browser and resumes them from the last completed part when you drop the same file again.
- The parts of an unfinished upload are stored data: they count toward your usage and your storage limit until the upload is completed or aborted.
- Unfinished multipart uploads that are never completed are cleaned up after 7 days.
- The ETag of a multipart object is not the MD5 of the whole file. Clients that verify by MD5 (rclone, the AWS CLI) know this and check part-by-part instead.
Data protection
Encryption
Every object gets its own random 256-bit key. Data is encrypted with AES-256-GCM in authenticated 1 MiB frames before it reaches storage, and each object key is wrapped by a master key held only by the gateway. The storage layer never sees plaintext, file names or your account.
Integrity
The MD5 (as the ETag) and SHA-256 of every upload are recorded. Reads are authenticated frame by frame; a corrupted frame fails the read rather than returning bad bytes.
Deletion
Deleting an object removes its record and destroys its encryption key immediately, so the stored ciphertext can never be read again, by us or anyone else. The ciphertext itself may stay on the storage layer. Overwriting an object replaces it; the previous contents are not kept. There is no versioning and no recycle bin.
Pricing and limits
| Item | Price |
|---|---|
| Storage | $3 per TB per month, charged by the day |
| Free allowance | The first 50 GB on every account |
| Downloads (egress) | Free |
| API requests | Free |
- How usage is measured. We record the largest amount each account stored on each day (UTC). Storage above the free 50 GB is charged at the daily share of the monthly rate, so one terabyte stored for 15 days of a 30-day month costs half of $3.
- Paying. Add a card on the Billing page of the console. After each month what you stored is added to your balance, and once the balance reaches $5 the card is charged for the whole amount. A smaller balance carries forward. There is no minimum charge and no commitment.
- Storing more than 50 GB. New accounts are limited to the free allowance. Add a card in the console to lift the limit; accounts with a card have no storage limit.
- Storage limit. When a free account reaches 50 GB, uploads are refused with the message storage limit reached (HTTP
413in the console,QuotaExceededover the S3 API). Delete data or add a card and uploads resume immediately. - Downloads are not metered or billed.
- Your usage and the charge for the current month so far are shown on the Account page of the console.
Supported S3 operations
| Operation | Status | Notes |
|---|---|---|
ListBuckets | Supported | Buckets owned by the key's account |
CreateBucket | Supported | Names are unique within your account; creating one you already have answers BucketAlreadyOwnedByYou |
DeleteBucket | Supported | Bucket must be empty |
HeadBucket | Supported | |
GetBucketLocation | Supported | Returns eu-ams-1 |
ListObjectsV2 | Supported | Prefix, delimiter, continuation tokens, start-after |
ListObjects (v1) | Supported | Marker pagination |
PutObject | Supported | Up to 5 GB per request; chunked and unsigned payloads accepted |
GetObject | Supported | Range requests, conditional headers |
HeadObject | Supported | |
DeleteObject | Supported | |
DeleteObjects | Supported | Up to 1000 keys per request |
CopyObject | Supported | Within your account; copies data server-side |
CreateMultipartUpload | Supported | |
UploadPart | Supported | 5 MB to 5 GB, 10,000 parts |
CompleteMultipartUpload | Supported | |
AbortMultipartUpload | Supported | |
ListParts | Supported | |
ListMultipartUploads | Supported | |
| Presigned URLs | Supported | GET and PUT, up to 7 days |
Not supported
| Feature | Status | Notes |
|---|---|---|
| Versioning | No | Overwrites and deletes are final |
| ACLs and bucket policies | No | Everything is private to the account; use share links or presigned URLs |
| Lifecycle rules | No | Use your client's retention (for example restic forget) |
| Static website hosting | No | |
| Object Lock and legal hold | No | |
| Object tagging and metadata queries | No | Content-Type is stored; other metadata is ignored |
| Server-side encryption headers | Ignored | Everything is already encrypted at rest; SSE headers are accepted and ignored |
| Virtual-host addressing | No | Use path-style |
Unsupported operations return a standard S3 NotImplemented error, which well-behaved clients report clearly.
FAQ and support
My client says "SignatureDoesNotMatch"
The usual causes are path-style addressing being disabled, an endpoint with a trailing slash or the wrong scheme, or a system clock that is more than 15 minutes off. The region can be anything, but it must be the same value in every place the client asks for it.
My client says "AccessDenied" on upload
Either the key is read-only or a free account has reached its storage limit, in which case the message says so. Check the key's scope and your usage in the console.
Listing is slow with a huge flat prefix
Listings return up to 1000 keys per page. Use a delimiter (/) and organise keys into prefixes; listing a prefix costs one lookup per child, not per descendant.
Can I get my data out in bulk?
Yes, at any time: rclone copy enderchest:bucket /local. Downloads are free.
Support
Email [email protected]. Include your account email, the bucket, the client and version, and the exact error. We reply within one business day.