<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
<!-- NERF is a trademark of defconxt. -->
# Implementing Immutable Backup Strategies — API Reference

## AWS S3 Object Lock

```bash
# Create bucket with Object Lock
aws s3api create-bucket --bucket BUCKET \
  --object-lock-enabled-for-bucket

# Set Compliance mode retention
aws s3api put-object-lock-configuration --bucket BUCKET \
  --object-lock-configuration '{
    "ObjectLockEnabled": "Enabled",
    "Rule": {"DefaultRetention": {"Mode": "COMPLIANCE", "Days": 30}}
  }'

# Check configuration
aws s3api get-object-lock-configuration --bucket BUCKET

# Upload with explicit lock
aws s3api put-object --bucket BUCKET --key KEY --body FILE \
  --object-lock-mode COMPLIANCE \
  --object-lock-retain-until-date "2026-04-16T00:00:00Z"

# Check object retention
aws s3api get-object-retention --bucket BUCKET --key KEY
```

## MinIO S3-Compatible (Self-Hosted)

```bash
# Enable Object Lock on bucket
mc mb --with-lock myminio/backup-immutable

# Set retention policy
mc retention set --default COMPLIANCE 30d myminio/backup-immutable

# Verify
mc retention info myminio/backup-immutable
```

## Linux Immutable Attribute

```bash
# Set immutable flag (requires root)
chattr +i /backup/file.vbk

# Verify immutable flag
lsattr /backup/file.vbk

# Remove immutable flag (emergency only)
chattr -i /backup/file.vbk

# Recursive set
find /backup/ -type f -exec chattr +i {} \;
```

## BorgBackup Append-Only

```bash
# Server authorized_keys config
command="borg serve --restrict-to-path /backup --append-only" ssh-rsa ...

# Verify append-only mode
borg config /backup/repo append_only
```

## Key Parameters

| Parameter | Description | Example |
|-----------|-------------|---------|
| `retention_days` | Minimum immutability period | `30` |
| `mode` | Object Lock mode | `COMPLIANCE`, `GOVERNANCE` |
| `bucket` | S3 bucket with Object Lock | `backup-immutable-prod` |
| `strategy` | Backup strategy rule | `3-2-1-1-0` |
