amadan
An off-account copy: carlos ops offsite to any S3-compatible destination Feature Request open
On branch design-carloku-durability
Everything carloku has, including SSM, the buckets and the tofu state, lives in one AWS account. There is no replication and no object lock, and the IE box role can s3:DeleteObjectVersion.
Proposal (design §5.5): carlos ops offsite copies the deployment bucket, every data bucket and every carlos-store-* bucket, plus named extras, to a second S3-compatible endpoint with its own credentials. It is incremental (Get+Put), runs every 15 minutes under the housekeeper lease, seals objects client-side to the deployment key, and publishes control/offsite.json for a lag alert. Destination for carloku: Hetzner Object Storage, versioned, with governance-mode object lock. Litestream 0.5 allows only one replica per database, so this copies replica prefixes rather than adding a second writer.