Connecting Storage

Storage backends hold your encrypted will documents. This guide covers connecting each supported storage type.

Using your own storage credentials? See Configuring user storages for step-by-step setup and links to Google Drive, Dropbox, OneDrive, and S3 guides.

Overview

BAP supports five storage backends:

You must connect at least one storage to create a will.

Adding Storage

Step 1: Navigate to Storage

1. Log into the Host Dashboard
2. Go to Settings → Storage
3. Click "Add Storage"

Step 2: Choose Storage Type

Select the type:

• Google Drive
• Dropbox
• OneDrive
• AWS S3
• FTP/SFTP

Step 3: Configure and Connect

Each type has different configuration (see below).

Step 4: Verify and Save

1. Click "Test Connection"
2. Select a folder for will documents
3. Click "Save Storage"

Google Drive

Prerequisites

• Google account
• Google Cloud project with Drive API enabled

Configuration

For OAuth connections, you don't enter credentials directly:

1. Click "Connect with Google"
2. Sign in with your Google account
3. Grant BAP access to Google Drive
4. Select a folder (or use default)
5. Connection is established

Google Cloud Setup (If Needed)

If you need to create your own OAuth credentials:

1. Go to console.cloud.google.com
2. Create new project
3. Enable Google Drive API
4. Create OAuth credentials (OAuth client ID)
5. Set redirect URI
6. Note client ID and secret

OAuth Callback

The redirect URL format:

https://yourdomain.com/api/storages/oauth/callback

Permissions

BAP requests:

• drive.file — Access to files you create
• Not full drive access

Testing

Click "Test Connection" to verify:

• Authentication works
• Can read/write to selected folder

Dropbox

Prerequisites

• Dropbox account
• Dropbox Developer app

Configuration

OAuth-based (similar to Google Drive):

1. Click "Connect with Dropbox"
2. Sign in to Dropbox
3. Grant BAP access
4. Select a folder

Creating Your Own App

1. Go to dropbox.com/developers
2. Create app (Scoped access)
3. Choose permissions: files.content.write, files.content.read
4. Set redirect URL
5. Note App Key and Secret

OAuth Callback

https://yourdomain.com/api/storages/oauth/callback

AWS S3

Prerequisites

• AWS account
• S3 bucket
• IAM user with S3 permissions

Configuration Fields

IAM Policy

Create IAM user with this policy:

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": [
        "s3:PutObject",
        "s3:GetObject",
        "s3:DeleteObject",
        "s3:ListBucket"
      ],
      "Resource": [
        "arn:aws:s3:::your-bucket",
        "arn:aws:s3:::your-bucket/*"
      ]
    }
  ]
}

S3-Compatible Storage

For S3-compatible providers (MinIO, DigitalOcean Spaces, Wasabi):

{
  "access_key_id": "...",
  "secret_access_key": "...",
  "bucket": "my-bap-wills",
  "region": "us-east-1",
  "endpoint": "https://nyc3.digitaloceanspaces.com",
  "path_style": true
}

Testing

Click "Test Connection" to verify:

• Credentials are valid
• Bucket exists and is accessible

FTP/SFTP

Prerequisites

• FTP or SFTP server
• Server credentials

Configuration Fields

SFTP Key Authentication

For SFTP with SSH keys:

{
  "host": "sftp.example.com",
  "port": 22,
  "username": "bap",
  "ssh_key": "-----BEGIN OPENSSH PRIVATE KEY-----\n...\n-----END OPENSSH PRIVATE KEY-----"
}

Security Notes

• SFTP (SSH) is encrypted
• FTP transmits in plaintext (not recommended)
• Use SSH key authentication over password

Testing

Click "Test Connection" to verify:

• Server is reachable
• Credentials work
• Directory exists/is writable

Managing Storage

Viewing Storage

Storage page shows:

Testing Storage

1. Click "Test" on a storage entry
2. System verifies:
   • Authentication
   • Read access
   • Write access

Reconnecting OAuth

For Google Drive or Dropbox:

1. Click "Reconnect"
2. Complete OAuth flow again
3. May be needed if token expired/revoked

Browsing Storage

To browse files in connected storage:

1. Click "Browse" on storage entry
2. View files and folders
3. Select folder for will documents

Deleting Storage

1. Click "Delete" on storage entry
2. Confirm deletion

Constraint: Cannot delete storage that contains active will documents.

File Handling

How BAP Uses Storage

1. Upload: Encrypted documents uploaded to storage
2. Download: Documents downloaded and decrypted for access
3. Delete: Encrypted blobs deleted when will is removed

File Naming

In storage, files are stored with opaque names:

/BAP/will/
  12345678-1234-1234-1234-123456789abc.enc
  87654321-4321-4321-4321-abcdef123456.enc

Original filenames are stored in database metadata, not in storage.

Folder Structure

Recommended structure:

/BAP/
  /wills/
    /{will-id}/
      document1.enc
      document2.enc

Best Practices

For Production

• Use dedicated bucket/folder for BAP
• Enable versioning for backup (but understand retention)
• Use S3-compatible for cost-effective storage

Security

• SFTP preferred over FTP
• OAuth tokens encrypted at rest
• Files always encrypted before upload

Redundancy

• Connect multiple storage options
• If one fails, system can use backup
• Regular testing recommended

Troubleshooting

"Authentication failed"

• Verify credentials are correct
• Check API keys haven't expired
• Ensure bucket/server is accessible

"OAuth token expired"

• Click "Reconnect" to refresh
• Check redirect URL matches

"Permission denied"

• Verify bucket/folder permissions
• Check IAM policy includes required actions

"Storage disconnected"

• Network connectivity issue
• Provider outage
• Re-authenticate if needed

"Upload failed"

• Check disk space
• Verify write permissions
• Try again or use different storage

API Reference

Storage can also be managed via API:

GET    /api/storages              - List storages
POST   /api/storages              - Create storage
GET    /api/storages/:id          - Get storage
PUT    /api/storages/:id          - Update storage
DELETE /api/storages/:id         - Delete storage
GET    /api/storages/:id/browse   - Browse files
POST   /api/storages/:id/connect  - OAuth flow

See API Reference - Storage for details.

Next Steps

• Creating a Will — Upload and seal will
• Liveness Settings — Configure checks
• Configuration — Full config reference