> ## Documentation Index
> Fetch the complete documentation index at: https://docs.polystack.tech/llms.txt
> Use this file to discover all available pages before exploring further.

# Tape and Object Storage

> Integrate LTO tape libraries and S3-compatible object storage as Ironcore Backup Solution backends for long-term archival and elastic capacity.

## Overview

Ironcore Backup Solution (IBS) supports two long-term archival backends:

* **LTO Tape Libraries** — LTO-5 and newer for offline, compliance-grade
  archival. Best for the **3-2-1 backup strategy** and immutable offline copies.
* **S3-Compatible Object Storage** — elastic capacity for the Backup site or
  cloud-based archival. Best for large archival retention without dedicated
  storage hardware.

This page covers tape library integration, S3 datastore configuration, and the
trade-offs between the two.

<Note>
  **Prerequisites**

  * Administrator role on the Polystack platform
  * For tape: an LTO-5 or newer drive, optionally with a tape autoloader
  * For S3: an S3-compatible endpoint, access credentials, and a bucket
</Note>

***

## When to Choose Tape vs. Object Storage

| Criterion               | Tape                                    | S3-Compatible                     |
| ----------------------- | --------------------------------------- | --------------------------------- |
| Offline / air-gap       | Yes (when ejected)                      | No                                |
| Compliance immutability | Strong (physical removal)               | Strong (bucket lock if supported) |
| Capacity scaling        | Manual (more tapes / library expansion) | Elastic                           |
| Throughput              | Sequential, high (200+ MB/s per drive)  | Variable, network-bound           |
| Random access           | Poor — sequential read required         | Good                              |
| Cost at scale           | Lowest per TB long-term                 | Pay-as-you-go                     |
| Operational overhead    | Higher (handling, vaulting, drives)     | Lower                             |

<Tip>
  Many sites combine both: S3 for the day-to-day archival and tape for yearly
  compliance snapshots vaulted offline.
</Tip>

***

## Tape Library Integration

### Supported Hardware

| Component       | Support                                               |
| --------------- | ----------------------------------------------------- |
| LTO Generations | LTO-5 and newer (LTO-4 best-effort)                   |
| Drives          | Single-drive or multi-drive libraries                 |
| Autoloaders     | SCSI / SAS media changers (probed via `pmtx`)         |
| Barcoded media  | Yes — barcode label generator included                |
| Encryption      | Drive-side or chunk-side (AES-256-GCM at chunk level) |

### Register a Tape Library

<Tabs>
  <Tab title="Deployment Console" icon="gauge">
    <Steps titleSize="h3">
      <Step title="Open Tape" icon="external-link">
        Navigate to **Backup Solution** > **Tape Backup** > **Libraries**.
      </Step>

      <Step title="Add a library" icon="plus">
        Click **Add Library**. Enter:

        * **Name**: `lto-library-01`
        * **Device path**: `/dev/sg5` (or the SCSI generic device)
        * **Type**: Autoloader
      </Step>

      <Step title="Scan media" icon="search">
        Click **Inventory**. The library scans every slot and registers
        barcoded media in the media catalog.
      </Step>

      <Step title="Configure drives" icon="settings">
        Open the **Drives** sub-page. Confirm each drive is detected and
        register its block size, compression, and encryption preferences.
      </Step>

      <Step title="Save" icon="check">
        Click **Save**.

        <Check>The library is online and ready for media pool assignment.</Check>
      </Step>
    </Steps>
  </Tab>

  <Tab title="CLI" icon="terminal">
    ```bash title="Register a tape library" theme={null}
    ironcore-backup tape library create \
      --name lto-library-01 \
      --path /dev/sg5 \
      --type autoloader
    ```

    ```bash title="Inventory all media" theme={null}
    ironcore-backup tape inventory --library lto-library-01
    ```
  </Tab>
</Tabs>

### Create a Media Pool

A media pool groups tapes that share the same purpose — for example, "yearly
archival" or "off-site rotation."

```bash title="Create a media pool" theme={null}
ironcore-backup tape pool create \
  --name yearly-archive \
  --retention "keep-yearly=7" \
  --encrypt-with project-master-key
```

### Schedule a Tape Backup Job

```bash title="Annual archival to tape" theme={null}
ironcore-backup tape backup \
  --pool yearly-archive \
  --include "keep-yearly=*" \
  --eject \
  --schedule "yearly 04:00"
```

| Flag         | Description                                                 |
| ------------ | ----------------------------------------------------------- |
| `--pool`     | Target media pool                                           |
| `--include`  | Filter expression for which snapshots to archive            |
| `--eject`    | Eject the tape after job completes — operator must vault it |
| `--schedule` | Run on a calendar schedule                                  |

### Tape Restore

```bash title="Restore a backup from tape" theme={null}
ironcore-backup tape restore \
  --media TAPE0042 \
  --target ibs-primary
```

The Tape Worker mounts the requested tape (autoloader) or prompts the operator
to insert it (manual). The chunks are read sequentially and rehydrated into the
target datastore. Restore continues from there using the standard pipeline.

### Barcode Label Generator

For libraries that ship without barcoded media, IBS includes a barcode label
generator. Print on Avery 5160 or compatible labels.

<Tabs>
  <Tab title="Deployment Console" icon="gauge">
    Navigate to **Tape Backup** > **Tools** > **Barcode Generator**.
    Enter a prefix and count, click **Generate PDF**.
  </Tab>

  <Tab title="CLI" icon="terminal">
    ```bash theme={null}
    ironcore-backup tape labels generate \
      --prefix TAPE \
      --start 1 \
      --count 100 \
      --output /tmp/labels.pdf
    ```
  </Tab>
</Tabs>

### Operator Workflow

```mermaid theme={null}
sequenceDiagram
    participant Op as Operator
    participant IBS
    participant Lib as Tape Library
    participant Vault as Off-site Vault

    Op->>IBS: Insert new barcoded media
    IBS->>Lib: Inventory new media
    Lib-->>IBS: Media catalogued
    IBS->>Lib: Run scheduled tape backup
    Lib-->>IBS: Backup complete
    IBS->>Lib: Eject media
    Op->>Vault: Transport media off-site
    Op->>Vault: Record vault entry
```

***

## S3-Compatible Object Storage

### Supported Endpoints

* AWS S3 and S3-compatible third-party services
* On-premises object storage gateways
* Polystack Object Storage service

### Create an S3 Datastore

See [Datastores](/services/ironcore-backup/admin-guide/datastores) for the full
provisioning procedure. The summary:

```bash theme={null}
ironcore-backup datastore create \
  --name ibs-archival-s3 \
  --type s3 \
  --endpoint https://s3.<your-domain> \
  --bucket polystack-backup-archival \
  --region default \
  --access-key "AKIA..." \
  --secret-key "..." \
  --gc-schedule "monthly" \
  --verify-schedule "monthly" \
  --request-rate-threshold 500
```

### Monitoring and Cost Control

| Telemetry                    | Use For                             |
| ---------------------------- | ----------------------------------- |
| **Request count per minute** | Detect runaway sync jobs            |
| **Egress bandwidth**         | Forecast monthly bandwidth cost     |
| **Stored bytes**             | Forecast monthly storage cost       |
| **Threshold alerts**         | Notify on request-count exceedances |

<Warning>
  Enable the **request-rate-threshold** alert on every S3 datastore. A
  misconfigured sync job can issue millions of unnecessary requests, driving up
  cost. The alert dispatches via the configured notification group.
</Warning>

### Lifecycle Policies

For very long-term archival, configure provider-side lifecycle policies on the
bucket — for example, transitioning older objects to colder storage classes.
IBS does not require any specific lifecycle setup, but interactions between
provider lifecycle and IBS pruning should be tested before going to production.

***

## Combined Tape + S3 Strategy

```mermaid theme={null}
graph LR
    A[Workload] -->|Backup| B[Primary DC datastore]
    B -->|Sun 04:30 sync| C[Backup site S3 datastore]
    C -->|Yearly archival| D[Tape library]
    D -->|Eject + vault| E[Off-site vault]
```

This layered topology gives you:

| Layer             | Recovery Window | Cost                    |
| ----------------- | --------------- | ----------------------- |
| Primary datastore | 1-3 weeks       | High (fast storage)     |
| Backup site S3    | 52 weeks        | Medium (object storage) |
| Tape library      | 7-25 years      | Low (cold storage)      |
| Off-site vault    | Indefinite      | Lowest (physical media) |

***

## Troubleshooting

<AccordionGroup>
  <Accordion title="Tape drive not detected" icon="alert-triangle">
    Verify the SCSI generic device exists (`lsscsi -g`). Confirm the user
    running the tape worker has read/write access to the device. Check the
    `dmesg` output for SCSI errors.
  </Accordion>

  <Accordion title="Inventory shows empty slots that contain tapes" icon="archive">
    The autoloader media changer may be stuck. Issue a manual library reset and
    re-inventory.

    ```bash theme={null}
    ironcore-backup tape library reset lto-library-01
    ironcore-backup tape inventory --library lto-library-01
    ```
  </Accordion>

  <Accordion title="S3 datastore returns HTTP 403" icon="lock">
    Credentials or bucket policy issue. Confirm the access key and secret key,
    and ensure the bucket policy permits `s3:PutObject`, `s3:GetObject`,
    `s3:DeleteObject`, and `s3:ListBucket`.
  </Accordion>

  <Accordion title="S3 datastore slow performance" icon="gauge">
    Throughput is bound by the endpoint and the network. Check the request
    rate in the Dashboard. Consider increasing parallel chunk uploads on the
    datastore configuration.
  </Accordion>
</AccordionGroup>

***

## Next Steps

<CardGroup cols={2}>
  <Card title="Replication and Sync" icon="arrow-left-right" href="/services/ironcore-backup/admin-guide/replication-sync" color="#bf9667">
    Replicate from Primary to S3 or tape staging
  </Card>

  <Card title="Datastores" icon="database" href="/services/ironcore-backup/admin-guide/datastores" color="#bf9667">
    Manage all datastore backends from one place
  </Card>

  <Card title="Retention Policies" icon="calendar-days" href="/services/ironcore-backup/admin-guide/retention-policies" color="#bf9667">
    Retention windows for tape and S3 long-term storage
  </Card>

  <Card title="Verification and Validation" icon="check" href="/services/ironcore-backup/admin-guide/verification-validation" color="#bf9667">
    Verify tape and S3-backed snapshots
  </Card>
</CardGroup>