Closed Alpha
FluxPlay is currently in Closed Alpha. This documentation is a work in progress and may be incomplete or out of date. Features, UI, and APIs are subject to change without notice. For access inquiries, please contact [email protected].
PHOTO BACKUP
Encrypted, redundant photo backup to any storage destination with snapshot-based restore. Protect your irreplaceable memories with zero-knowledge encryption.
Zero-Knowledge Backup
Encryption keys never leave your server. Even if your cloud storage provider is compromised, your photos remain unreadable. You are the only one who can restore them.
Capabilities
Storage Destinations
Back up to Amazon S3, Backblaze B2, any S3-compatible provider, or a local directory path on the server.
AES-256-GCM Encryption
Every backup object is encrypted client-side before upload. The storage destination never sees plaintext data.
Snapshot Backups
Each scheduled run creates a point-in-time snapshot. Old snapshots are retained per your policy and can be browsed independently.
3-Stage Restore
Preview what will be restored, perform a partial test restore to a staging folder, then execute a full restore with one click.
Retention Policy
Define how many daily, weekly, and monthly snapshots to keep. Expired snapshots are pruned automatically.
Health Monitoring
Backup jobs report success, failure, and storage usage metrics. Alerts fire when a backup has not run within the expected window.
Storage Destinations
Multiple backup destinations can be configured simultaneously. A single snapshot can be pushed to both a local NAS path and a cloud bucket for true 3-2-1 redundancy.
Amazon S3
Standard, Infrequent Access, and Glacier storage classes supported.
Backblaze B2
Cost-effective cold storage with S3-compatible API.
Local Path
Any mounted directory: NAS, external drive, or secondary disk.
Encryption
Photos are encrypted using AES-256-GCM before being written to any destination. A unique data encryption key (DEK) is generated per backup job and wrapped with your master key stored in the FluxPlay key store. The key store itself is encrypted at rest using your server's configured secret.
Encryption chain
- 1Master key derived from server secret (PBKDF2-SHA512, 600 000 iterations)
- 2Per-job DEK generated with CSPRNG, wrapped by master key
- 3Each photo encrypted with DEK + unique IV using AES-256-GCM
- 4Wrapped DEK stored alongside snapshot manifest (also encrypted)
Restore Stages
Restoring photos is a three-stage process designed to prevent accidental data loss and allow partial verification before committing a full restore.
Preview
View a manifest of all photos in the selected snapshot — names, sizes, dates — without downloading any data.
Partial Restore
Download and decrypt a user-selected subset of photos into a temporary staging folder for verification.
Full Restore
Decrypt and place all photos from the snapshot back into the photo library, merging with existing content or replacing it.