Restore from R2 — VALIDATED

Extracted from the master document on 2026-09-04. The §N numbering is kept so cross-references are not broken.

48. Restore from R2 — the off-site path — ✅ VALIDATED (2026-09-04)

This is the test that was missing for the homelab to have a complete recovery story: until now R2 was a destination things were uploaded to, not an origin anything had been recovered from.

Cloudflare R2 (bucket, names and content encrypted)
      │
      │ rclone crypt — `secure:` remote
      ▼
download to local disk on Proxmox
      │
      │ .vma.zst intact and decompressible
      ▼
qmrestore → VM 199
      │
      ▼
boots, filesystem OK, Debian OK, Docker OK   ✅

What this test really exercised, and no previous test had touched: that the R2 credentials work for reading, not just for writing; that the two passwords for the secure: remote stored in Vaultwarden do in fact decrypt; that an archive that travelled encrypted and came back is still valid; and that the whole path fits in the disk and the time available.

48.1 Layer 2 (Borg) from R2 — validated by extension

The Layer 2 restore from R2 is taken as valid on the basis that it is the same secure: remote, the same Cloudflare account and the same encryption mechanism that has just been shown to work with Layer 1.

What this test did NOT exercise, said plainly. The test downloaded secure:pve-vzdump, not secure:borg-docker-host: that is a different prefix, with a different volume and a different shape (thousands of small chunks instead of one big file). And above all, a Borg archive recovered from R2 still needs the repository’s repokey-blake2 passphrase to be opened — a credential different from the two for the crypt remote, which this test did not use. If that passphrase were lost, the repo mirrored to R2 would be unreadable even if the download worked perfectly.

That is why section 28 still stands: the cheap test that would close this gap completely is to download an archive from secure:borg-docker-host and run a borg list against it. It is a matter of minutes and turns a reasonable extension into a verified fact.

---