Skip to content

Closed Alpha

FluxPlay is currently in Closed Alpha. This documentation is a work in progress and may be incomplete or out of date. Features, UI, and APIs are subject to change without notice. For access inquiries, please contact [email protected].

PHOTO BACKUP

Encrypted, redundant photo backup to any storage destination with snapshot-based restore. Protect your irreplaceable memories with zero-knowledge encryption.

Zero-Knowledge Backup

Encryption keys never leave your server. Even if your cloud storage provider is compromised, your photos remain unreadable. You are the only one who can restore them.

Capabilities

Storage Destinations

Back up to Amazon S3, Backblaze B2, any S3-compatible provider, or a local directory path on the server.

AES-256-GCM Encryption

Every backup object is encrypted client-side before upload. The storage destination never sees plaintext data.

Snapshot Backups

Each scheduled run creates a point-in-time snapshot. Old snapshots are retained per your policy and can be browsed independently.

3-Stage Restore

Preview what will be restored, perform a partial test restore to a staging folder, then execute a full restore with one click.

Retention Policy

Define how many daily, weekly, and monthly snapshots to keep. Expired snapshots are pruned automatically.

Health Monitoring

Backup jobs report success, failure, and storage usage metrics. Alerts fire when a backup has not run within the expected window.

Storage Destinations

Multiple backup destinations can be configured simultaneously. A single snapshot can be pushed to both a local NAS path and a cloud bucket for true 3-2-1 redundancy.

Amazon S3

Standard, Infrequent Access, and Glacier storage classes supported.

Backblaze B2

Cost-effective cold storage with S3-compatible API.

Local Path

Any mounted directory: NAS, external drive, or secondary disk.

Encryption

Photos are encrypted using AES-256-GCM before being written to any destination. A unique data encryption key (DEK) is generated per backup job and wrapped with your master key stored in the FluxPlay key store. The key store itself is encrypted at rest using your server's configured secret.

Encryption chain

  1. 1Master key derived from server secret (PBKDF2-SHA512, 600 000 iterations)
  2. 2Per-job DEK generated with CSPRNG, wrapped by master key
  3. 3Each photo encrypted with DEK + unique IV using AES-256-GCM
  4. 4Wrapped DEK stored alongside snapshot manifest (also encrypted)

Restore Stages

Restoring photos is a three-stage process designed to prevent accidental data loss and allow partial verification before committing a full restore.

1

Preview

View a manifest of all photos in the selected snapshot — names, sizes, dates — without downloading any data.

2

Partial Restore

Download and decrypt a user-selected subset of photos into a temporary staging folder for verification.

3

Full Restore

Decrypt and place all photos from the snapshot back into the photo library, merging with existing content or replacing it.