fix: postgres keep_ownership flag

Add `options: HashMap<String, serde_json::Value>` to DatabaseConfig and
`options: Option<HashMap<...>>` to InputDatabaseConfig so callers can
pass arbitrary per-database options (e.g. keep_ownership for pg_dumpall).
Update all DatabaseConfig struct literals in test files and add three
new config-service unit tests covering present, absent, and non-bool values.

.github/workflows/windows-release.yml

@@ -0,0 +1,96 @@
+name: Build Windows release
+
+
+on:
+  workflow_dispatch:
+  push:
+    tags:
+      - '[0-9]+.[0-9]+.[0-9]+'
+    branches:
+      - main
+      - master
+
+jobs:
+  build-windows:
+    runs-on: windows-latest
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Rust toolchain (MSVC)
+        uses: actions-rs/toolchain@v1
+        with:
+          toolchain: stable-x86_64-pc-windows-msvc
+          profile: minimal
+          override: true
+
+      - name: Install vcpkg and OpenSSL (x64)
+        shell: pwsh
+        run: |
+          # Install vcpkg and the prebuilt OpenSSL package
+          git clone https://github.com/microsoft/vcpkg C:\vcpkg
+          C:\vcpkg\bootstrap-vcpkg.bat
+          C:\vcpkg\vcpkg install openssl:x64-windows
+          # Export variables for subsequent steps
+          'VCPKG_ROOT=C:\vcpkg' | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          'OPENSSL_DIR=C:\vcpkg\installed\x64-windows' | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+
+      - name: Build (cargo release)
+        shell: pwsh
+        env:
+          # Cargo / openssl-sys will pick up OPENSSL_DIR from the environment
+          OPENSSL_DIR: ${{ env.OPENSSL_DIR }}
+        run: |
+          # Ensure the environment variable is present for this step
+          if (-Not $env:OPENSSL_DIR) { Write-Host "OPENSSL_DIR not set, printing env for debugging"; Get-ChildItem Env: | ForEach-Object { Write-Host $_ } }
+          # Build the declared bin target explicitly (Cargo.toml [[bin]] name = "app")
+          cargo build --release --bin app
+
+      - name: Prepare artifact zip
+        id: prepare_artifact
+        shell: pwsh
+        env:
+          RELEASE_TAG: ${{ github.ref_name }}
+        run: |
+          $tag = $env:RELEASE_TAG
+          if (-not $tag) { $tag = $env:GITHUB_SHA }
+
+          # Package the declared bin target deterministically (Cargo.toml [[bin]] name = "app")
+          $exe = "target\release\app.exe"
+          if (-not (Test-Path $exe)) { Write-Error "Built binary $exe not found in target/release"; exit 1 }
+
+          $outDir = "artifact"
+          New-Item -ItemType Directory -Path $outDir -Force | Out-Null
+          # Ship under the package name, not the internal bin name "app"
+          Copy-Item -Path $exe -Destination "$outDir\portabase-agent.exe"
+
+          $zipName = "windows-release-$tag.zip"
+          if (Test-Path $zipName) { Remove-Item $zipName }
+          Compress-Archive -Path "$outDir\*" -DestinationPath $zipName -Force
+          Write-Host "ZIP=$zipName"
+          Write-Output "zip=$zipName" | Out-File -FilePath $env:GITHUB_OUTPUT -Encoding utf8 -Append
+
+      - name: Upload build artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: windows-release
+          path: windows-release-*.zip
+
+      - name: Create GitHub Release
+        if: startsWith(github.ref, 'refs/tags/')
+        id: create_release
+        uses: softprops/action-gh-release@v1
+        with:
+          tag_name: ${{ github.ref_name }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload release asset
+        if: startsWith(github.ref, 'refs/tags/')
+        uses: actions/upload-release-asset@v1
+        with:
+          upload_url: ${{ steps.create_release.outputs.upload_url }}
+          asset_path: windows-release-${{ github.ref_name }}.zip
+          asset_name: windows-release-${{ github.ref_name }}.zip
+          asset_content_type: application/zip

.gitignore

@@ -6,4 +6,5 @@
 .env
 
 .claude
-/docs
+
+/docs

CITATION.cff

@@ -27,5 +27,5 @@ keywords:
   - self-hosted
   - portabase
 license: Apache-2.0
-version: 1.12.0
+version: 1.14.0
 date-released: '2026-02-24'

Cargo.toml

@@ -1,6 +1,6 @@
 [package]
 name = "portabase-agent"
-version = "1.12.0"
+version = "1.14.0"
 edition = "2024"
 
 [dependencies]
@@ -39,6 +39,10 @@ tokio-util = { version = "0.7.18", features = ["compat"] }
 tiberius = { version = "0.12", default-features = false, features = ["rustls", "chrono"] }
 aws-config = "1.8.13"
 aws-sdk-s3 = { version = "1.122.0", features = ["behavior-version-latest"] }
+azure_core = "1.0.0"
+azure_storage_blob = "1.0.0"
+google-cloud-storage = "1.15"
+google-cloud-auth = "1.13"
 async-compression = { version = "0.4.37", features = ["tokio", "gzip"] }
 tokio-tar = "0.3.1"
 oauth2 = "5.0.0"

databases.json

@@ -10,6 +10,19 @@
       "host": "db-postgres",
       "generated_id": "16678159-ff7e-4c97-8c83-0adeff214681"
     },
+    {
+      "name": "Test database 1 - PostgreSQL - BIS",
+      "database": "devdb2",
+      "type": "postgresql",
+      "username": "devuser2",
+      "password": "changeme2",
+      "port": 5432,
+      "host": "db-postgres-2",
+      "generated_id": "16678159-ff7e-5697-8c83-0adeff214681",
+      "options": {
+        "keep_ownership": true
+      }
+    },
     {
       "name": "Test database 2 - MariaDB",
       "database": "mariadb",

docker-compose.databases.yml

@@ -15,6 +15,20 @@ services:
     networks:
       - portabase
 
+  db-postgres-2:
+    container_name: db-postgres-2
+    image: postgres:17-alpine
+    ports:
+      - "5438:5432"
+    volumes:
+      - postgres-data-2:/var/lib/postgresql/data
+    environment:
+      - POSTGRES_DB=devdb2
+      - POSTGRES_USER=devuser2
+      - POSTGRES_PASSWORD=changeme2
+    networks:
+      - portabase
+
   db-mariadb:
     container_name: db-mariadb
     image: mariadb:latest
@@ -179,6 +193,7 @@ services:
 
 volumes:
   postgres-data:
+  postgres-data-2:
   mariadb-data:
   mysql-data:
   mongodb-data:

docker-compose.yml

@@ -19,7 +19,7 @@ services:
       APP_ENV: development
       LOG: debug
       TZ: "Europe/Paris"
-      EDGE_KEY: "eyJzZXJ2ZXJVcmwiOiJodHRwOi8vbG9jYWxob3N0Ojg4ODciLCJhZ2VudElkIjoiMGZiNDYyMmUtMTMxNS00MzMxLTlkMTMtZWMzMjAyZjZiNTIwIiwibWFzdGVyS2V5QjY0IjoiMUh0djdtWCtYVkJxL0IzUEV2WDlZZjlQeUdVZW5oRHlXemo5THRqNW90WT0ifQ=="
+      EDGE_KEY: "eyJzZXJ2ZXJVcmwiOiJodHRwOi8vbG9jYWxob3N0Ojg4ODciLCJhZ2VudElkIjoiNWE2YjcxMDgtMGJhYS00Yjg1LTgwMmMtNTNjNjJiMDAzZDgzIiwibWFzdGVyS2V5QjY0IjoiMUh0djdtWCtYVkJxL0IzUEV2WDlZZjlQeUdVZW5oRHlXemo5THRqNW90WT0ifQ=="
       #CHUNK_SIZE_MB: "1"
       #POOLING: 1
       #DATABASES_CONFIG_FILE: "config.toml"
@@ -27,6 +27,11 @@ services:
       - "localhost:host-gateway"
     networks:
       - portabase
+    cpus: "1.50"
+    mem_limit: 4g
+    memswap_limit: 4g
+    pids_limit: 512
+
 
 volumes:
   cargo-registry:

docker/Dockerfile

@@ -1,3 +1,11 @@
+# =========================
+# MySQL client tools
+# =========================
+FROM mysql:8.4 AS mysql-client-tools
+RUN mkdir -p /mysql-exports/bin /mysql-exports/lib \
+    && cp /usr/bin/mysqldump /mysql-exports/bin/ \
+    && find /usr/lib -name "libmysqlclient.so.21*" -exec cp {} /mysql-exports/lib/ \;
+
 # =========================
 # Base image (shared)
 # =========================
@@ -68,6 +76,13 @@ RUN if [ "$TARGETARCH" = "amd64" ]; then \
 COPY assets/tools/${TARGETARCH}/mongodb/ /usr/local/mongodb/
 RUN chmod +x /usr/local/mongodb/bin/*
 
+# =========================
+# MySQL real mysqldump binary
+# =========================
+COPY --from=mysql-client-tools /mysql-exports/bin/mysqldump /usr/local/bin/mysqldump
+COPY --from=mysql-client-tools /mysql-exports/lib/ /usr/local/lib/
+RUN chmod +x /usr/local/bin/mysqldump && ldconfig
+
 WORKDIR /app
 
 # =========================
@@ -135,6 +150,9 @@ RUN chmod +x /entrypoint.sh
 COPY --from=base /usr/lib/postgresql/ /usr/lib/postgresql/
 COPY --from=base /usr/local/mongodb/bin/ /usr/local/mongodb/bin/
 COPY --from=base /root/.dotnet/tools/ /root/.dotnet/tools/
+COPY --from=mysql-client-tools /mysql-exports/bin/mysqldump /usr/local/bin/mysqldump
+COPY --from=mysql-client-tools /mysql-exports/lib/ /usr/local/lib/
+RUN chmod +x /usr/local/bin/mysqldump && ldconfig
 
 ENV PATH="$PATH:/usr/local/dotnet:/root/.dotnet/tools"
 ENV APP_ENV=production

src/domain/factory.rs

@@ -1,5 +1,6 @@
 use crate::domain::mongodb::database::MongoDatabase;
 use crate::domain::mysql::database::MySQLDatabase;
+use crate::domain::postgres::cluster::database::PostgresClusterDatabase;
 use crate::domain::postgres::database::PostgresDatabase;
 use crate::domain::postgres::{detect_format_from_file, detect_format_from_size};
 use crate::domain::redis::database::RedisDatabase;
@@ -31,6 +32,7 @@ impl DatabaseFactory {
                 let format = detect_format_from_size(&cfg).await;
                 Arc::new(PostgresDatabase::new(cfg, format))
             }
+            DbType::PostgresqlCluster => Arc::new(PostgresClusterDatabase::new(cfg)),
             DbType::Mysql => Arc::new(MySQLDatabase::new(cfg)),
             DbType::Mariadb => Arc::new(MariaDBDatabase::new(cfg)),
             DbType::MongoDB => Arc::new(MongoDatabase::new(cfg)),
@@ -48,6 +50,7 @@ impl DatabaseFactory {
                 let format = detect_format_from_file(restore_file);
                 Arc::new(PostgresDatabase::new(cfg, format))
             }
+            DbType::PostgresqlCluster => Arc::new(PostgresClusterDatabase::new(cfg)),
             DbType::Mysql => Arc::new(MySQLDatabase::new(cfg)),
             DbType::Mariadb => Arc::new(MariaDBDatabase::new(cfg)),
             DbType::MongoDB => Arc::new(MongoDatabase::new(cfg)),

src/domain/mariadb/backup.rs

@@ -33,6 +33,11 @@ pub async fn run(
         let _mariadb_dump = select_mariadb_path(&version).join("mariadb-dump");
 
         logger.log("debug", format!("Using mariadb-dump at {}", _mariadb_dump.display()));
+
+        if let Ok(out) = Command::new("mariadb-dump").arg("--version").output() {
+            logger.log("debug", format!("mariadb-dump client: {}", String::from_utf8_lossy(&out.stdout).trim()));
+        }
+
         logger.log("info", format!("Running mariadb-dump for {}", cfg.name));
 
         let start = Instant::now();
@@ -50,7 +55,7 @@ pub async fn run(
             .arg("--skip-add-drop-table")
             .arg("--compress")
             .arg("--verbose")
-            .arg("--max-allowed-packet=512M")
+            .arg(format!("--max-allowed-packet={}", cfg.max_packet_size))
             .arg("--net-buffer-length=16K")
             .arg("--default-character-set=utf8mb4")
             .arg(&cfg.database)

src/domain/mariadb/restore.rs

@@ -2,7 +2,6 @@ use crate::services::backup::logger::JobLogger;
 use crate::services::config::DatabaseConfig;
 use anyhow::{Context, Result};
 use std::fs::File;
-use std::io::{Read, Write};
 use std::path::PathBuf;
 use std::process::Command;
 use std::sync::Arc;
@@ -12,11 +11,8 @@ pub async fn run(cfg: DatabaseConfig, restore_file: PathBuf, logger: Arc<JobLogg
     let handle = tokio::task::spawn_blocking(move || -> Result<()> {
         logger.log("info", format!("Starting restore for database {}", cfg.name));
 
-        let mut sql_content = String::new();
         let mut file = File::open(&restore_file)
             .with_context(|| format!("Failed to open restore file {}", restore_file.display()))?;
-        file.read_to_string(&mut sql_content)
-            .with_context(|| format!("Failed to read restore file {}", restore_file.display()))?;
 
         let drop_create_cmd = format!(
             "DROP DATABASE IF EXISTS `{0}`; CREATE DATABASE `{0}`;",
@@ -66,10 +62,8 @@ pub async fn run(cfg: DatabaseConfig, restore_file: PathBuf, logger: Arc<JobLogg
             .with_context(|| format!("Failed to start MariaDB restore for {}", cfg.name))?;
 
         let mut stdin = child.stdin.take().context("Failed to open child stdin")?;
-        stdin
-            .write_all(sql_content.as_bytes())
-            .context("Failed to write SQL content to MariaDB stdin")?;
-        stdin.flush()?;
+        std::io::copy(&mut file, &mut stdin)
+            .context("Failed to stream SQL content to MariaDB stdin")?;
         drop(stdin);
 
         let output = child

src/domain/mysql/backup.rs

@@ -31,6 +31,10 @@ pub async fn run(
 
         let file_path = backup_dir.join(format!("{}{}", cfg.generated_id, file_extension));
 
+        if let Ok(out) = Command::new("mysqldump").arg("--version").output() {
+            logger.log("debug", format!("mysqldump client: {}", String::from_utf8_lossy(&out.stdout).trim()));
+        }
+
         logger.log("info", format!("Running mysqldump for {}", cfg.name));
 
         let start = Instant::now();
@@ -43,11 +47,15 @@ pub async fn run(
             .arg("--triggers")
             .arg("--verbose")
             .arg("--single-transaction")
+            .arg("--set-gtid-purged=OFF")
+            .arg("--no-tablespaces")
             .arg("--quick")
             .arg("--skip-lock-tables")
             .arg("--skip-add-drop-table")
             .arg("--no-create-db")
             .arg("--default-character-set=utf8mb4")
+            .arg("--network-timeout")
+            .arg(format!("--max-allowed-packet={}", cfg.max_packet_size))
             .arg(&cfg.database)
             .arg("-r").arg(&file_path)
             .envs(env)

src/domain/mysql/restore.rs

@@ -2,7 +2,6 @@ use crate::services::backup::logger::JobLogger;
 use crate::services::config::DatabaseConfig;
 use anyhow::{Context, Result};
 use std::fs::File;
-use std::io::{Read, Write};
 use std::path::PathBuf;
 use std::process::Command;
 use std::sync::Arc;
@@ -12,11 +11,8 @@ pub async fn run(cfg: DatabaseConfig, restore_file: PathBuf, logger: Arc<JobLogg
     let handle = tokio::task::spawn_blocking(move || -> Result<()> {
         logger.log("info", format!("Starting restore for database {}", cfg.name));
 
-        let mut sql_content = String::new();
         let mut file = File::open(&restore_file)
             .with_context(|| format!("Failed to open restore file {}", restore_file.display()))?;
-        file.read_to_string(&mut sql_content)
-            .with_context(|| format!("Failed to read restore file {}", restore_file.display()))?;
 
         let drop_create_cmd = format!(
             "DROP DATABASE IF EXISTS `{0}`; CREATE DATABASE `{0}`;",
@@ -66,10 +62,8 @@ pub async fn run(cfg: DatabaseConfig, restore_file: PathBuf, logger: Arc<JobLogg
             .with_context(|| format!("Failed to start mysql restore for {}", cfg.name))?;
 
         let mut stdin = child.stdin.take().context("Failed to open child stdin")?;
-        stdin
-            .write_all(sql_content.as_bytes())
-            .context("Failed to write SQL content to mysql stdin")?;
-        stdin.flush()?;
+        std::io::copy(&mut file, &mut stdin)
+            .context("Failed to stream SQL content to mysql stdin")?;
         drop(stdin);
 
         let output = child

src/domain/postgres/backup.rs

@@ -1,4 +1,5 @@
 use anyhow::Result;
+use std::collections::HashMap;
 use std::path::PathBuf;
 use std::process::Command;
 use std::sync::Arc;
@@ -13,6 +14,7 @@ pub async fn run(
     cfg: DatabaseConfig,
     format: PostgresDumpFormat,
     backup_dir: PathBuf,
+    env: HashMap<String, String>,
     logger: Arc<JobLogger>,
 ) -> Result<PathBuf> {
     tokio::task::spawn_blocking(move || -> Result<PathBuf> {
@@ -37,18 +39,18 @@ pub async fn run(
                 logger.log("info", format!("Running FC backup for {}", cfg.name));
 
                 let file_path = backup_dir.join(format!("{}.dump", cfg.generated_id));
-                let url = format!(
-                    "postgresql://{}:{}@{}:{}/{}",
-                    cfg.username, cfg.password, cfg.host, cfg.port, cfg.database
-                );
 
                 let start = Instant::now();
                 let output = Command::new(&pg_dump)
-                    .arg("--dbname").arg(&url)
+                    .arg("--host").arg(&cfg.host)
+                    .arg("--port").arg(cfg.port.to_string())
+                    .arg("--username").arg(&cfg.username)
+                    .arg("--dbname").arg(&cfg.database)
                     .arg("-Fc")
                     .arg("-f").arg(&file_path)
                     .arg("-v")
                     .arg("--compress=3")
+                    .envs(env)
                     .output();
                 let duration_ms = start.elapsed().as_millis() as f64;
 
@@ -87,19 +89,19 @@ pub async fn run(
                     return Err(e.into());
                 }
 
-                let url = format!(
-                    "postgresql://{}:{}@{}:{}/{}",
-                    cfg.username, cfg.password, cfg.host, cfg.port, cfg.database
-                );
-                let cmd_label = format!("pg_dump -Fd {}", url);
+                let cmd_label = format!("pg_dump -Fd {}@{}:{}/{}", cfg.username, cfg.host, cfg.port, cfg.database);
 
                 let start = Instant::now();
                 let output = Command::new(&pg_dump)
-                    .arg("--dbname").arg(&url)
+                    .arg("--host").arg(&cfg.host)
+                    .arg("--port").arg(cfg.port.to_string())
+                    .arg("--username").arg(&cfg.username)
+                    .arg("--dbname").arg(&cfg.database)
                     .arg("-Fd")
                     .arg("-j").arg("4")
                     .arg("-f").arg(&dump_dir)
                     .arg("-v")
+                    .envs(env)
                     .output();
                 let duration_ms = start.elapsed().as_millis() as f64;
 

src/domain/postgres/cluster/backup.rs

@@ -0,0 +1,81 @@
+use anyhow::Result;
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::process::Command;
+use std::sync::Arc;
+use std::time::Instant;
+
+use super::super::connection::{
+    is_superuser, pg_dumpall_binary_name, select_pg_path, server_version,
+};
+use crate::services::backup::logger::JobLogger;
+use crate::services::config::DatabaseConfig;
+
+pub async fn run(
+    cfg: DatabaseConfig,
+    backup_dir: PathBuf,
+    env: HashMap<String, String>,
+    logger: Arc<JobLogger>,
+) -> Result<PathBuf> {
+    tokio::task::spawn_blocking(move || -> Result<PathBuf> {
+        logger.log("info", format!("Starting cluster backup for {}", cfg.name));
+
+        let version = match futures::executor::block_on(server_version(&cfg)) {
+            Ok(v) => v,
+            Err(e) => {
+                logger.log("error", format!("Failed to get server version for {}: {:?}", cfg.name, e));
+                return Err(e.into());
+            }
+        };
+
+        match futures::executor::block_on(is_superuser(&cfg)) {
+            Ok(true) => {}
+            Ok(false) => {
+                logger.log("error", format!("postgresql-cluster backup requires a superuser role for {}", cfg.name));
+                anyhow::bail!("postgresql-cluster backup requires a superuser role for {}", cfg.name);
+            }
+            Err(e) => {
+                logger.log("error", format!("Failed to check superuser status for {}: {:?}", cfg.name, e));
+                return Err(e.into());
+            }
+        }
+
+        let pg_dumpall = select_pg_path(&version).join(pg_dumpall_binary_name());
+        let file_path = backup_dir.join(format!("{}.sql", cfg.generated_id));
+
+        logger.log("info", format!("Running pg_dumpall for cluster {} via {:?}", cfg.name, pg_dumpall));
+
+        let start = Instant::now();
+        let output = Command::new(&pg_dumpall)
+            .arg("--host").arg(&cfg.host)
+            .arg("--port").arg(cfg.port.to_string())
+            .arg("--username").arg(&cfg.username)
+            .arg("--clean")
+            .arg("--if-exists")
+            .arg("-v")
+            .arg("-f").arg(&file_path)
+            .envs(env)
+            .output();
+        let duration_ms = start.elapsed().as_millis() as f64;
+
+        match output {
+            Ok(o) => {
+                let stderr = String::from_utf8_lossy(&o.stderr).to_string();
+                let exit_code = o.status.code().unwrap_or(-1);
+                if o.status.success() {
+                    logger.log_command("pg_dumpall", if stderr.is_empty() { None } else { Some(stderr) }, Some(0), Some(duration_ms));
+                    logger.log("info", format!("Cluster backup completed for {} at {:?}", cfg.name, file_path));
+                    Ok(file_path)
+                } else {
+                    logger.log_command("pg_dumpall", Some(stderr), Some(exit_code), Some(duration_ms));
+                    anyhow::bail!("Cluster backup (pg_dumpall) failed for {}", cfg.name);
+                }
+            }
+            Err(e) => {
+                logger.log_command("pg_dumpall", Some(e.to_string()), Some(-1), Some(duration_ms));
+                Err(e.into())
+            }
+        }
+    })
+    .await?
+}

src/domain/postgres/cluster/database.rs

@@ -0,0 +1,53 @@
+use anyhow::Result;
+use async_trait::async_trait;
+use std::collections::HashMap;
+use std::path::{Path, PathBuf};
+use std::sync::Arc;
+
+use super::super::ping;
+use super::{backup, restore};
+use crate::domain::factory::Database;
+use crate::services::backup::logger::JobLogger;
+use crate::services::config::DatabaseConfig;
+use crate::utils::locks::{DbOpLock, FileLock};
+
+pub struct PostgresClusterDatabase {
+    pub cfg: DatabaseConfig,
+}
+
+impl PostgresClusterDatabase {
+    pub fn new(cfg: DatabaseConfig) -> Self {
+        Self { cfg }
+    }
+
+    fn build_env(&self) -> HashMap<String, String> {
+        let mut envs = std::env::vars().collect::<HashMap<_, _>>();
+        envs.insert("PGPASSWORD".to_string(), self.cfg.password.to_string());
+        envs
+    }
+}
+
+#[async_trait]
+impl Database for PostgresClusterDatabase {
+    fn file_extension(&self) -> &'static str {
+        ".sql"
+    }
+
+    async fn ping(&self) -> Result<bool> {
+        ping::run(self.cfg.clone()).await
+    }
+
+    async fn backup(&self, dir: &Path, logger: Arc<JobLogger>) -> Result<PathBuf> {
+        FileLock::acquire(&self.cfg.generated_id, DbOpLock::Backup.as_str()).await?;
+        let res = backup::run(self.cfg.clone(), dir.to_path_buf(), self.build_env(), logger).await;
+        FileLock::release(&self.cfg.generated_id).await?;
+        res
+    }
+
+    async fn restore(&self, file: &Path, logger: Arc<JobLogger>) -> Result<()> {
+        FileLock::acquire(&self.cfg.generated_id, DbOpLock::Restore.as_str()).await?;
+        let res = restore::run(self.cfg.clone(), file.to_path_buf(), self.build_env(), logger).await;
+        FileLock::release(&self.cfg.generated_id).await?;
+        res
+    }
+}

src/domain/postgres/cluster/mod.rs

@@ -0,0 +1,3 @@
+pub mod backup;
+pub mod database;
+pub mod restore;

src/domain/postgres/cluster/restore.rs

@@ -0,0 +1,84 @@
+use anyhow::Result;
+use std::collections::HashMap;
+use std::path::PathBuf;
+use std::process::Command;
+use std::sync::Arc;
+use std::time::Instant;
+
+use super::super::connection::{is_superuser, psql_binary_name, select_pg_path, server_version, terminate_all_connections};
+use crate::services::backup::logger::JobLogger;
+use crate::services::config::DatabaseConfig;
+
+pub async fn run(
+    cfg: DatabaseConfig,
+    restore_file: PathBuf,
+    env: HashMap<String, String>,
+    logger: Arc<JobLogger>,
+) -> Result<()> {
+    tokio::task::spawn_blocking(move || -> Result<()> {
+        logger.log("info", format!("Starting cluster restore for {}", cfg.name));
+
+        let version = match futures::executor::block_on(server_version(&cfg)) {
+            Ok(v) => v,
+            Err(e) => {
+                logger.log("error", format!("Failed to get server version for {}: {:?}", cfg.name, e));
+                return Err(e.into());
+            }
+        };
+
+        match futures::executor::block_on(is_superuser(&cfg)) {
+            Ok(true) => {}
+            Ok(false) => {
+                logger.log("error", format!("postgresql-cluster restore requires a superuser role for {}", cfg.name));
+                anyhow::bail!("postgresql-cluster restore requires a superuser role for {}", cfg.name);
+            }
+            Err(e) => {
+                logger.log("error", format!("Failed to check superuser status for {}: {:?}", cfg.name, e));
+                return Err(e.into());
+            }
+        }
+
+        let psql = select_pg_path(&version).join(psql_binary_name());
+
+        if let Err(e) = futures::executor::block_on(terminate_all_connections(&cfg)) {
+            logger.log("error", format!("Failed to terminate connections for cluster {}: {:?}", cfg.name, e));
+            return Err(e.into());
+        }
+        logger.log("info", format!("All user database connections terminated for cluster {}", cfg.name));
+
+        logger.log("info", format!("Replaying cluster dump for {} via {:?}", cfg.name, psql));
+
+        let start = Instant::now();
+        let output = Command::new(&psql)
+            .arg("--host").arg(&cfg.host)
+            .arg("--port").arg(cfg.port.to_string())
+            .arg("--username").arg(&cfg.username)
+            .arg("--dbname").arg("postgres")
+            .arg("-f").arg(&restore_file)
+            .envs(env)
+            .output();
+        let duration_ms = start.elapsed().as_millis() as f64;
+
+        match output {
+            Ok(o) => {
+                let stderr = String::from_utf8_lossy(&o.stderr).to_string();
+                let stdout = String::from_utf8_lossy(&o.stdout).to_string();
+                let combined = format!("{}{}", stdout, stderr);
+                let exit_code = o.status.code().unwrap_or(-1);
+                if o.status.success() {
+                    logger.log_command("psql", if combined.is_empty() { None } else { Some(combined) }, Some(0), Some(duration_ms));
+                    logger.log("info", format!("Cluster restore completed for {}", cfg.name));
+                    Ok(())
+                } else {
+                    logger.log_command("psql", if combined.is_empty() { None } else { Some(combined) }, Some(exit_code), Some(duration_ms));
+                    anyhow::bail!("Cluster restore (psql) failed for {}", cfg.name);
+                }
+            }
+            Err(e) => {
+                logger.log_command("psql", Some(e.to_string()), Some(-1), Some(duration_ms));
+                Err(e.into())
+            }
+        }
+    })
+    .await?
+}

src/domain/postgres/connection.rs

@@ -1,18 +1,23 @@
 use crate::domain::postgres::format::PostgresDumpFormat;
 use crate::services::config::DatabaseConfig;
+use crate::settings::CONFIG;
 use anyhow::Result;
 use std::path::Path;
-use tokio_postgres::{Client, NoTls};
+use tokio_postgres::{Client, Config, NoTls};
 use tracing::{error, info};
 
 pub async fn connect(cfg: &DatabaseConfig) -> Result<Client> {
     info!("Connecting to postgres database {}:{}", cfg.host, cfg.port);
-    let dsn = format!(
-        "host={} port={} user={} password={} dbname={}",
-        cfg.host, cfg.port, cfg.username, cfg.password, cfg.database
-    );
 
-    let (client, connection) = tokio_postgres::connect(&dsn, NoTls).await?;
+    let mut config = Config::new();
+    config
+        .host(&cfg.host)
+        .port(cfg.port)
+        .user(&cfg.username)
+        .password(&cfg.password)
+        .dbname(&cfg.database);
+
+    let (client, connection) = config.connect(NoTls).await?;
     tokio::spawn(async move {
         if let Err(e) = connection.await {
             error!("Postgres connection error: {}", e);
@@ -28,11 +33,96 @@ pub async fn server_version(cfg: &DatabaseConfig) -> Result<String> {
     Ok(version)
 }
 
+pub async fn is_superuser(cfg: &DatabaseConfig) -> Result<bool> {
+    let client = connect(cfg).await?;
+    let is_super: bool = client
+        .query_one("SELECT current_setting('is_superuser') = 'on';", &[])
+        .await?
+        .get(0);
+
+    Ok(is_super)
+}
+
+
 pub fn select_pg_path(version: &str) -> std::path::PathBuf {
+    select_pg_path_with(version, &CONFIG.pg_bin_dir)
+}
+
+pub(crate) fn select_pg_path_with(version: &str, pg_bin_dir: &str) -> std::path::PathBuf {
     let major = version.split('.').next().unwrap_or("17");
+
+    if !pg_bin_dir.is_empty() {
+        return pg_bin_dir.into();
+    }
+
+    let candidates: Vec<std::path::PathBuf> = if cfg!(target_os = "windows") {
+        vec![
+            // Default install path used by the official EDB Windows installer
+            format!(r"C:\Program Files\PostgreSQL\{major}\bin").into(),
+            format!(r"C:\Program Files (x86)\PostgreSQL\{major}\bin").into(),
+        ]
+    } else if cfg!(target_os = "macos") {
+        vec![
+            // Homebrew on Apple Silicon
+            format!("/opt/homebrew/opt/postgresql@{major}/bin").into(),
+            // Homebrew on Intel
+            format!("/usr/local/opt/postgresql@{major}/bin").into(),
+            // Postgres.app
+            format!("/Applications/Postgres.app/Contents/Versions/{major}/bin").into(),
+        ]
+    } else {
+        vec![
+            // Debian/Ubuntu packages
+            format!("/usr/lib/postgresql/{major}/bin").into(),
+            // Common RPM-based distro layout
+            format!("/usr/pgsql-{major}/bin").into(),
+        ]
+    };
+
+    if let Some(found) = candidates.into_iter().find(|p| pg_dump_exists_in(p)) {
+        return found;
+    }
+
+    if let Some(dir) = find_pg_dump_in_path() {
+        return dir;
+    }
+
     format!("/usr/lib/postgresql/{}/bin", major).into()
 }
 
+pub(crate) fn pg_dump_binary_name() -> &'static str {
+    if cfg!(target_os = "windows") {
+        "pg_dump.exe"
+    } else {
+        "pg_dump"
+    }
+}
+
+pub(crate) fn pg_dumpall_binary_name() -> &'static str {
+    if cfg!(target_os = "windows") {
+        "pg_dumpall.exe"
+    } else {
+        "pg_dumpall"
+    }
+}
+
+pub(crate) fn psql_binary_name() -> &'static str {
+    if cfg!(target_os = "windows") {
+        "psql.exe"
+    } else {
+        "psql"
+    }
+}
+
+pub(crate) fn pg_dump_exists_in(dir: &std::path::Path) -> bool {
+    dir.join(pg_dump_binary_name()).is_file()
+}
+
+fn find_pg_dump_in_path() -> Option<std::path::PathBuf> {
+    let path_var = std::env::var_os("PATH")?;
+    std::env::split_paths(&path_var).find(|dir| pg_dump_exists_in(dir))
+}
+
 pub async fn terminate_connections(cfg: &DatabaseConfig) -> Result<()> {
     let mut admin = cfg.clone();
     admin.database = "postgres".to_string().into();
@@ -54,6 +144,27 @@ pub async fn terminate_connections(cfg: &DatabaseConfig) -> Result<()> {
     Ok(())
 }
 
+pub async fn terminate_all_connections(cfg: &DatabaseConfig) -> Result<()> {
+    let mut admin = cfg.clone();
+    admin.database = "postgres".to_string().into();
+
+    let client = connect(&admin).await?;
+
+    client
+        .execute(
+            r#"
+            SELECT pg_terminate_backend(pid)
+            FROM pg_stat_activity
+            WHERE datname NOT IN ('postgres', 'template0', 'template1')
+              AND pid <> pg_backend_pid();
+            "#,
+            &[],
+        )
+        .await?;
+
+    Ok(())
+}
+
 pub fn detect_format_from_file(restore_file: &Path) -> PostgresDumpFormat {
     match restore_file.extension().and_then(|e| e.to_str()) {
         Some("dump") => PostgresDumpFormat::Fc,
@@ -68,6 +179,7 @@ pub async fn detect_format_from_size(cfg: &DatabaseConfig) -> PostgresDumpFormat
         "Detecting database format {:?} - {:?}",
         cfg.name, cfg.generated_id
     );
+
     let client = match connect(cfg).await {
         Ok(c) => c,
         Err(_) => return PostgresDumpFormat::Fc,

src/domain/postgres/database.rs

@@ -1,8 +1,8 @@
 use anyhow::Result;
 use async_trait::async_trait;
+use std::collections::HashMap;
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
-
 use super::{backup, format::PostgresDumpFormat, ping, restore};
 use crate::domain::factory::Database;
 use crate::services::backup::logger::JobLogger;
@@ -18,6 +18,12 @@ impl PostgresDatabase {
     pub fn new(cfg: DatabaseConfig, format: PostgresDumpFormat) -> Self {
         Self { cfg, format }
     }
+
+    fn build_env(&self) -> HashMap<String, String> {
+        let mut envs = std::env::vars().collect::<HashMap<_, _>>();
+        envs.insert("PGPASSWORD".to_string(), self.cfg.password.to_string());
+        envs
+    }
 }
 
 #[async_trait]
@@ -35,14 +41,28 @@ impl Database for PostgresDatabase {
 
     async fn backup(&self, dir: &Path, logger: Arc<JobLogger>) -> Result<PathBuf> {
         FileLock::acquire(&self.cfg.generated_id, DbOpLock::Backup.as_str()).await?;
-        let res = backup::run(self.cfg.clone(), self.format, dir.to_path_buf(), logger).await;
+        let res = backup::run(
+            self.cfg.clone(),
+            self.format,
+            dir.to_path_buf(),
+            self.build_env(),
+            logger,
+        )
+        .await;
         FileLock::release(&self.cfg.generated_id).await?;
         res
     }
 
     async fn restore(&self, file: &Path, logger: Arc<JobLogger>) -> Result<()> {
         FileLock::acquire(&self.cfg.generated_id, DbOpLock::Restore.as_str()).await?;
-        let res = restore::run(self.cfg.clone(), self.format, file.to_path_buf(), logger).await;
+        let res = restore::run(
+            self.cfg.clone(),
+            self.format,
+            file.to_path_buf(),
+            self.build_env(),
+            logger,
+        )
+        .await;
         FileLock::release(&self.cfg.generated_id).await?;
         res
     }

src/domain/postgres/mod.rs

@@ -1,5 +1,6 @@
 pub mod backup;
-mod connection;
+pub(crate) mod cluster;
+pub(crate) mod connection;
 pub mod database;
 mod format;
 mod ping;

src/domain/postgres/restore.rs

@@ -1,4 +1,5 @@
 use anyhow::Result;
+use std::collections::HashMap;
 use std::path::PathBuf;
 use std::process::Command;
 use std::sync::Arc;
@@ -13,6 +14,7 @@ pub async fn run(
     cfg: DatabaseConfig,
     format: PostgresDumpFormat,
     restore_file: PathBuf,
+    env: HashMap<String, String>,
     logger: Arc<JobLogger>,
 ) -> Result<()> {
     tokio::task::spawn_blocking(move || -> Result<()> {
@@ -39,26 +41,36 @@ pub async fn run(
         }
         logger.log("info", format!("Connections terminated for database {}", cfg.name));
 
-        let url = format!(
-            "postgresql://{}:{}@{}:{}/{}",
-            cfg.username, cfg.password, cfg.host, cfg.port, cfg.database
-        );
+        let keep_ownership = cfg.options
+            .get("keep_ownership")
+            .and_then(|v| v.as_bool())
+            .unwrap_or(false);
+
+        if keep_ownership {
+            logger.log("info", format!("Restoring ownership and privileges for {}", cfg.name));
+        } else {
+            logger.log("info", format!("Stripping ownership and privileges for {} (--no-owner --no-privileges)", cfg.name));
+        }
 
         match format {
             PostgresDumpFormat::Fc => {
                 logger.log("info", format!("Running FC restore for {}", cfg.name));
                 let start = Instant::now();
-                let output = Command::new(&pg_restore)
-                    .arg("--no-owner")
-                    .arg("--no-privileges")
+                let mut cmd = Command::new(&pg_restore);
+                if !keep_ownership {
+                    cmd.arg("--no-owner").arg("--no-privileges");
+                }
+                let output = cmd
                     .arg("--clean")
                     .arg("--if-exists")
                     // .arg("--create")
-                    .arg("--dbname")
-                    .arg(&url)
+                    .arg("--host").arg(&cfg.host)
+                    .arg("--port").arg(cfg.port.to_string())
+                    .arg("--username").arg(&cfg.username)
+                    .arg("--dbname").arg(&cfg.database)
                     .arg("-v")
                     .arg(&restore_file)
-                    .env("PGPASSWORD", &cfg.password)
+                    .envs(env)
                     .output();
 
                 let duration_ms = start.elapsed().as_millis() as f64;
@@ -148,19 +160,23 @@ pub async fn run(
                 };
 
                 let start = Instant::now();
-                let output = Command::new(&pg_restore)
-                    .arg("--no-owner")
-                    .arg("--no-privileges")
+                let mut cmd = Command::new(&pg_restore);
+                if !keep_ownership {
+                    cmd.arg("--no-owner").arg("--no-privileges");
+                }
+                let output = cmd
                     .arg("--clean")
                     .arg("--if-exists")
                     // .arg("--create")
-                    .arg("--dbname")
-                    .arg(&url)
+                    .arg("--host").arg(&cfg.host)
+                    .arg("--port").arg(cfg.port.to_string())
+                    .arg("--username").arg(&cfg.username)
+                    .arg("--dbname").arg(&cfg.database)
                     .arg("-v")
                     .arg("-j")
                     .arg("4")
                     .arg(dump_dir)
-                    .env("PGPASSWORD", &cfg.password)
+                    .envs(env)
                     .output();
 
                 let duration_ms = start.elapsed().as_millis() as f64;

src/services/api/models/agent/status.rs

@@ -1,6 +1,6 @@
 #![allow(dead_code)]
 
-use crate::utils::deserializer::deserialize_snake_case;
+use crate::utils::deserializer::{deserialize_snake_case, string_or_number_to_string};
 use serde::{Deserialize, Serialize};
 use toml::Value;
 
@@ -54,4 +54,6 @@ pub struct RestoreInfo {
     pub file: Option<String>,
     #[serde(rename = "metaFile")]
     pub meta_file: Option<String>,
+    #[serde(default, deserialize_with = "string_or_number_to_string")]
+    pub size: Option<String>,
 }

src/services/backup/uploader.rs

@@ -115,6 +115,28 @@ impl BackupService {
                         storage_id,
                         upload_result.error.as_deref().unwrap_or("unknown error")
                     ));
+
+                    // `backup_upload_init` opened a per-storage record; close it as "failed"
+                    // so the server is notified of the failure (no path/size on this path).
+                    if let Err(err) = ctx_clone
+                        .api
+                        .backup_upload_status(
+                            ctx_clone.edge_key.agent_id.clone(),
+                            generated_id.clone(),
+                            backup_storage_id.clone(),
+                            status,
+                            String::new(),
+                            0u64,
+                            backup_id,
+                        )
+                        .await
+                    {
+                        logger_clone.log("error", format!(
+                            "Failed-status update failed for {}: {}",
+                            storage_id, err
+                        ));
+                    }
+
                     return upload_result;
                 }
 

src/services/config.rs

@@ -3,6 +3,7 @@
 use crate::core::context::Context;
 use serde::Deserialize;
 use serde_json;
+use std::collections::HashMap;
 use std::fs::File;
 use std::io::Read;
 use std::path::Path;
@@ -17,6 +18,8 @@ pub enum DbType {
     Mysql,
     Mariadb,
     Postgresql,
+    #[serde(rename = "postgresql-cluster")]
+    PostgresqlCluster,
     MongoDB,
     Sqlite,
     Redis,
@@ -31,6 +34,7 @@ impl DbType {
             DbType::Mysql => "mysql",
             DbType::Mariadb => "mariadb",
             DbType::Postgresql => "postgresql",
+            DbType::PostgresqlCluster => "postgresql-cluster",
             DbType::MongoDB => "mongodb",
             DbType::Sqlite => "sqlite",
             DbType::Redis => "redis",
@@ -54,6 +58,8 @@ pub struct DatabaseConfig {
     pub host: String,
     pub generated_id: String,
     pub path: String,
+    pub max_packet_size: String,
+    pub options: HashMap<String, serde_json::Value>,
 }
 
 #[allow(dead_code)]
@@ -75,6 +81,8 @@ pub struct InputDatabaseConfig {
     pub host: Option<String>,
     pub generated_id: String,
     pub path: Option<String>,
+    pub max_packet_size: Option<String>,
+    pub options: Option<HashMap<String, serde_json::Value>>,
 }
 
 #[allow(dead_code)]
@@ -167,21 +175,26 @@ impl ConfigService {
             }
 
             let username = match db.db_type {
-                DbType::Postgresql | DbType::Mysql | DbType::Mariadb | DbType::Mssql => {
-                    required(&db.username, &db.name, "username")?
-                }
+                DbType::Postgresql
+                | DbType::PostgresqlCluster
+                | DbType::Mysql
+                | DbType::Mariadb
+                | DbType::Mssql => required(&db.username, &db.name, "username")?,
                 _ => optional(&db.username),
             };
 
             let password = match db.db_type {
-                DbType::Postgresql | DbType::Mysql | DbType::Mariadb | DbType::Mssql => {
-                    required(&db.password, &db.name, "password")?
-                }
+                DbType::Postgresql
+                | DbType::PostgresqlCluster
+                | DbType::Mysql
+                | DbType::Mariadb
+                | DbType::Mssql => required(&db.password, &db.name, "password")?,
                 _ => optional(&db.password),
             };
 
             let host = match db.db_type {
                 DbType::Postgresql
+                | DbType::PostgresqlCluster
                 | DbType::Mysql
                 | DbType::Mariadb
                 | DbType::MongoDB
@@ -194,6 +207,7 @@ impl ConfigService {
 
             let port = match db.db_type {
                 DbType::Postgresql
+                | DbType::PostgresqlCluster
                 | DbType::Mysql
                 | DbType::Mariadb
                 | DbType::MongoDB
@@ -206,6 +220,10 @@ impl ConfigService {
 
             let database_name = match db.db_type {
                 DbType::Sqlite | DbType::Redis | DbType::Valkey => optional(&db.database),
+                DbType::PostgresqlCluster => db
+                    .database
+                    .clone()
+                    .unwrap_or_else(|| "postgres".to_string()),
                 _ => required(&db.database, &db.name, "database")?,
             };
 
@@ -214,6 +232,13 @@ impl ConfigService {
                 _ => optional(&db.path),
             };
 
+            let max_packet_size = match db.db_type {
+                DbType::Mysql | DbType::Mariadb => {
+                    db.max_packet_size.unwrap_or_else(|| "512M".to_string())
+                }
+                _ => String::new(),
+            };
+
             databases.push(DatabaseConfig {
                 name: db.name,
                 database: database_name,
@@ -224,6 +249,8 @@ impl ConfigService {
                 port,
                 generated_id: db.generated_id,
                 path: path_val,
+                max_packet_size,
+                options: db.options.unwrap_or_default(),
             });
         }
 

src/services/mod.rs

@@ -4,4 +4,4 @@ pub mod config;
 pub mod cron;
 pub mod restore;
 pub mod status;
-mod storage;
+pub mod storage;

src/services/restore/dispatcher.rs

@@ -20,6 +20,8 @@ impl RestoreService {
             return;
         };
 
+        let expected_size = db.data.restore.size.clone();
+
         let service = Self {
             ctx: self.ctx.clone(),
         };
@@ -27,7 +29,10 @@ impl RestoreService {
         let db_cfg = cfg.clone();
 
         tokio::spawn(async move {
-            if let Err(e) = service.execute_restore(db_cfg, file_to_restore).await {
+            if let Err(e) = service
+                .execute_restore(db_cfg, file_to_restore, expected_size)
+                .await
+            {
                 error!("Restore failed: {}", e);
             }
         });

src/services/restore/downloader.rs

@@ -1,20 +1,40 @@
 use super::service::RestoreService;
 
 use anyhow::Result;
+use futures::StreamExt;
 use reqwest::{Client, Url};
 use std::path::{Path, PathBuf};
 use std::sync::Arc;
+use std::time::Instant;
+use tokio::io::AsyncWriteExt;
 use crate::services::backup::logger::JobLogger;
 
+fn human_size(bytes: u64) -> String {
+    if bytes >= 1024 * 1024 {
+        format!("{} MB", bytes / 1024 / 1024)
+    } else if bytes >= 1024 {
+        format!("{} KB", bytes / 1024)
+    } else {
+        format!("{bytes} B")
+    }
+}
+
 impl RestoreService {
-    pub async fn download_backup(&self, file_url: &str, tmp_path: &Path, logger: Arc<JobLogger>) -> Result<PathBuf> {
+    pub async fn download_backup(
+        &self,
+        file_url: &str,
+        tmp_path: &Path,
+        logger: Arc<JobLogger>,
+        expected_size: Option<String>,
+    ) -> Result<PathBuf> {
         logger.log("info", "Start downloading backup archive".to_string());
 
         let client = Client::new();
 
         let response = client.get(file_url).send().await?;
+        let status = response.status();
 
-        if !response.status().is_success() {
+        if !status.is_success() {
             logger.log("error", "Failed to download".to_string());
             anyhow::bail!("download failed");
         }
@@ -39,11 +59,66 @@ impl RestoreService {
 
         let path = tmp_path.join(&filename);
 
-        let bytes = response.bytes().await?;
+        let total = expected_size
+            .as_deref()
+            .and_then(|s| s.trim().parse::<u64>().ok())
+            .filter(|&n| n > 0);
 
-        tokio::fs::write(&path, &bytes).await?;
+        logger.log(
+            "info",
+            format!(
+                "Downloading backup '{}' ({})",
+                filename,
+                total.map(human_size).unwrap_or_else(|| "unknown size".to_string())
+            ),
+        );
+
+        let start = Instant::now();
+        let mut file = tokio::fs::File::create(&path).await?;
+        let mut stream = response.bytes_stream();
+        let mut downloaded: u64 = 0;
+        let mut next_pct: u64 = 10;
+
+        while let Some(chunk) = stream.next().await {
+            let chunk = chunk?;
+            file.write_all(&chunk).await?;
+            downloaded += chunk.len() as u64;
+
+            if let Some(total) = total {
+                let pct = (downloaded.saturating_mul(100) / total).min(100);
+                let milestone = pct / 10 * 10;
+                if milestone >= next_pct {
+                    logger.log(
+                        "info",
+                        format!(
+                            "Download progress: {}% ({} / {} bytes)",
+                            milestone, downloaded, total
+                        ),
+                    );
+                    next_pct = milestone + 10;
+                }
+            }
+        }
+
+        file.flush().await?;
+
+        if downloaded == 0 {
+            logger.log(
+                "warn",
+                format!("Downloaded 0 bytes (status {status}); backup body was empty"),
+            );
+        }
+
+        logger.log(
+            "info",
+            format!(
+                "Backup downloaded to {} ( {} bytes in {:.1}s)",
+                path.display(),
+                downloaded,
+                start.elapsed().as_secs_f64()
+            ),
+        );
 
-        logger.log("info", format!("Backup downloaded to {}", path.display()));
         Ok(path)
     }
 }

src/services/restore/executor.rs

@@ -7,7 +7,12 @@ use std::time::Instant;
 use tempfile::TempDir;
 
 impl RestoreService {
-    pub async fn execute_restore(&self, cfg: DatabaseConfig, file_url: String) -> Result<()> {
+    pub async fn execute_restore(
+        &self,
+        cfg: DatabaseConfig,
+        file_url: String,
+        expected_size: Option<String>,
+    ) -> Result<()> {
         let logger = Arc::new(JobLogger::new());
         let start = Instant::now();
 
@@ -18,7 +23,9 @@ impl RestoreService {
 
         logger.log("info", format!("Created temp directory {}", tmp_path.display()));
 
-        let downloaded = self.download_backup(&file_url, tmp_path, Arc::clone(&logger)).await?;
+        let downloaded = self
+            .download_backup(&file_url, tmp_path, Arc::clone(&logger), expected_size)
+            .await?;
 
         let backup_file = self.prepare_archive(downloaded, tmp_path, Arc::clone(&logger)).await?;
 

src/services/storage/mod.rs

@@ -5,6 +5,8 @@ use crate::services::api::models::agent::status::DatabaseStorage;
 use crate::services::backup::models::{BackupResult, UploadResult};
 use crate::utils::common::BackupMethod;
 use async_trait::async_trait;
+use providers::azure_blob;
+use providers::google_cloud_storage;
 use providers::google_drive;
 use providers::local;
 use providers::s3;
@@ -31,7 +33,11 @@ pub fn get_provider(storage: &DatabaseStorage) -> Option<Box<dyn StorageProvider
     match storage.provider.as_str() {
         "local" => Some(Box::new(local::LocalProvider {})),
         "s3" => Some(Box::new(s3::S3Provider {})),
+        "blob" => Some(Box::new(azure_blob::AzureBlobProvider {})),
         "google-drive" => Some(Box::new(google_drive::GoogleDriveProvider {})),
+        "google-cloud-storage" => Some(Box::new(
+            google_cloud_storage::GoogleCloudStorageProvider {},
+        )),
         _ => {
             error!("Unknown storage provider: {}", storage.provider);
             None

src/services/storage/providers/azure_blob/helpers.rs

@@ -0,0 +1,174 @@
+use anyhow::{Context as _, Result, anyhow};
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD;
+use chrono::{Duration, Utc};
+use openssl::hash::MessageDigest;
+use openssl::pkey::PKey;
+use openssl::sign::Signer;
+use url::Url;
+use azure_core::http::RequestContent;
+use azure_storage_blob::clients::{BlobClient, BlockBlobClient};
+use azure_storage_blob::models::BlockLookupList;
+use bytes::{Bytes, BytesMut};
+use futures::{Stream, StreamExt};
+use std::pin::Pin;
+use tracing::info;
+
+#[derive(Debug, Clone)]
+pub struct ResolvedAzure {
+    pub account_name: String,
+    pub account_key: String,
+    pub blob_endpoint: String,
+}
+
+#[derive(Clone, Copy)]
+pub enum SasResource {
+    Blob,
+    #[allow(dead_code)]
+    Container,
+}
+
+impl SasResource {
+    fn code(self) -> &'static str {
+        match self { SasResource::Blob => "b", SasResource::Container => "c" }
+    }
+}
+
+pub(crate) const SAS_VERSION: &str = "2022-11-02";
+
+pub(crate) fn hmac_sha256_b64(key: &[u8], data: &str) -> Result<String> {
+    let pkey = PKey::hmac(key).context("hmac key")?;
+    let mut signer = Signer::new(MessageDigest::sha256(), &pkey).context("signer")?;
+    signer.update(data.as_bytes()).context("signer update")?;
+    let sig = signer.sign_to_vec().context("sign")?;
+    Ok(STANDARD.encode(sig))
+}
+
+pub fn build_service_sas(
+    resolved: &ResolvedAzure,
+    canonical_resource: &str,
+    resource: SasResource,
+    permissions: &str,
+) -> Result<Vec<(String, String)>> {
+    let key = STANDARD
+        .decode(&resolved.account_key)
+        .map_err(|_| anyhow!("account key is not valid base64"))?;
+
+    let signed_start = String::new();
+    let signed_expiry = (Utc::now() + Duration::hours(1))
+        .format("%Y-%m-%dT%H:%M:%SZ").to_string();
+    let signed_protocol = "https,http"; // Azurite is http
+    let signed_resource = resource.code();
+
+    let string_to_sign = format!(
+        "{sp}\n{st}\n{se}\n{canon}\n{si}\n{sip}\n{spr}\n{sv}\n{sr}\n{snap}\n{enc}\n{rscc}\n{rscd}\n{rsce}\n{rscl}\n{rsct}",
+        sp = permissions, st = signed_start, se = signed_expiry, canon = canonical_resource,
+        si = "", sip = "", spr = signed_protocol, sv = SAS_VERSION, sr = signed_resource,
+        snap = "", enc = "", rscc = "", rscd = "", rsce = "", rscl = "", rsct = "",
+    );
+
+    let sig = hmac_sha256_b64(&key, &string_to_sign)?;
+
+    Ok(vec![
+        ("sv".into(), SAS_VERSION.into()),
+        ("sr".into(), signed_resource.into()),
+        ("sp".into(), permissions.into()),
+        ("se".into(), signed_expiry),
+        ("spr".into(), signed_protocol.into()),
+        ("sig".into(), sig),
+    ])
+}
+
+pub fn build_sas_url(
+    resolved: &ResolvedAzure,
+    container: &str,
+    blob: &str,
+    resource: SasResource,
+    permissions: &str,
+) -> Result<Url> {
+    let canonical = if blob.is_empty() {
+        format!("/blob/{}/{}", resolved.account_name, container)
+    } else {
+        format!("/blob/{}/{}/{}", resolved.account_name, container, blob)
+    };
+    let pairs = build_service_sas(resolved, &canonical, resource, permissions)?;
+
+    let base = if blob.is_empty() {
+        format!("{}/{}", resolved.blob_endpoint.trim_end_matches('/'), container)
+    } else {
+        format!("{}/{}/{}", resolved.blob_endpoint.trim_end_matches('/'), container, blob)
+    };
+
+    let mut url = Url::parse(&base).context("invalid blob endpoint/url")?;
+    {
+        let mut qp = url.query_pairs_mut();
+        for (k, v) in pairs { qp.append_pair(&k, &v); }
+    }
+    Ok(url)
+}
+
+pub const BLOCK_SIZE: usize = 100 * 1024 * 1024;
+
+type ByteStream = Pin<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>>;
+
+async fn stage_block(
+    bbc: &BlockBlobClient,
+    index: u32,
+    block: Bytes,
+    block_ids: &mut Vec<Vec<u8>>,
+) -> Result<()> {
+    let raw_id = format!("{index:032}").into_bytes();
+    let len = block.len() as u64;
+    bbc.stage_block(&raw_id, len, RequestContent::from(block.to_vec()), None)
+        .await
+        .map_err(|e| anyhow!("stage_block {index} failed: {e}"))?;
+    block_ids.push(raw_id);
+    info!("staged azure block {index} ({len} bytes)");
+    Ok(())
+}
+
+pub async fn upload_stream_to_azure(
+    resolved: &ResolvedAzure,
+    container: &str,
+    blob: &str,
+    mut body: ByteStream,
+    block_size: usize,
+) -> Result<()> {
+    let url = build_sas_url(resolved, container, blob, SasResource::Blob, "cw")?;
+    let blob_client = BlobClient::new(url, None, None).context("blob client")?;
+    let bbc = blob_client.block_blob_client();
+
+    let mut buffer = BytesMut::with_capacity(block_size);
+    let mut block_ids: Vec<Vec<u8>> = Vec::new();
+    let mut index: u32 = 0;
+
+    while let Some(item) = body.next().await {
+        let bytes = item.context("stream error during upload")?;
+        buffer.extend_from_slice(&bytes);
+
+        while buffer.len() >= block_size {
+            let block = buffer.split_to(block_size).freeze();
+            stage_block(&bbc, index, block, &mut block_ids).await?;
+            index += 1;
+        }
+    }
+
+    if !buffer.is_empty() {
+        let block = buffer.split().freeze();
+        stage_block(&bbc, index, block, &mut block_ids).await?;
+    }
+
+    if block_ids.is_empty() {
+        stage_block(&bbc, 0, Bytes::new(), &mut block_ids).await?;
+    }
+
+    let block_list = BlockLookupList {
+        latest: Some(block_ids),
+        ..Default::default()
+    };
+    bbc.commit_block_list(block_list.try_into()?, None)
+        .await
+        .map_err(|e| anyhow!("commit_block_list failed: {e}"))?;
+
+    Ok(())
+}

src/services/storage/providers/azure_blob/mod.rs

@@ -0,0 +1,134 @@
+pub mod helpers;
+pub(crate) mod models;
+
+use crate::core::context::Context;
+use crate::services::api::models::agent::status::DatabaseStorage;
+use crate::services::backup::models::{BackupResult, UploadResult};
+use crate::services::storage::StorageProvider;
+use crate::services::storage::providers::azure_blob::helpers::{BLOCK_SIZE, upload_stream_to_azure};
+use crate::services::storage::providers::azure_blob::models::AzureBlobProviderConfig;
+use crate::utils::common::BackupMethod;
+use crate::utils::file::{full_file_name, full_file_path};
+use crate::utils::stream::build_stream;
+use async_trait::async_trait;
+use std::sync::Arc;
+use tokio::fs;
+use tracing::{error, info};
+
+pub struct AzureBlobProvider {}
+
+#[async_trait]
+impl StorageProvider for AzureBlobProvider {
+    async fn upload(
+        &self,
+        ctx: Arc<Context>,
+        result: BackupResult,
+        _method: BackupMethod,
+        storage: &DatabaseStorage,
+        encrypt: Option<bool>,
+    ) -> UploadResult {
+        let Some(file_path) = result.backup_file else {
+            return UploadResult {
+                storage_id: storage.id.clone(),
+                success: false,
+                error: Some("Missing backup file path".to_string()),
+                remote_file_path: None,
+                total_size: None,
+            };
+        };
+
+        let total_size = match fs::metadata(&file_path).await {
+            Ok(meta) => meta.len(),
+            Err(e) => {
+                error!("Failed to get file size: {}", e);
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let encrypt = encrypt.unwrap_or(false);
+
+        let upload = match build_stream(&file_path, encrypt, &ctx.edge_key.master_key_b64).await {
+            Ok(u) => u,
+            Err(e) => {
+                error!("Stream build failed: {}", e);
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let config: AzureBlobProviderConfig = match storage.clone().config.try_into() {
+            Ok(c) => c,
+            Err(e) => {
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let resolved = match config.resolve() {
+            Ok(r) => r,
+            Err(e) => {
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let file_name = full_file_name(encrypt);
+        let remote_file_path = full_file_path(&file_name);
+        info!(
+            "Starting block upload to azure blob {}/{}",
+            config.container_name, remote_file_path
+        );
+
+        match upload_stream_to_azure(
+            &resolved,
+            &config.container_name,
+            &remote_file_path,
+            upload.stream,
+            BLOCK_SIZE,
+        )
+        .await
+        {
+            Ok(_) => {
+                info!("Azure blob upload successful: {}", remote_file_path);
+                UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: true,
+                    error: None,
+                    remote_file_path: Some(remote_file_path),
+                    total_size: Some(total_size),
+                }
+            }
+            Err(e) => {
+                error!("Azure blob upload failed: {:?}", e);
+                UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                }
+            }
+        }
+    }
+}

src/services/storage/providers/azure_blob/models.rs

@@ -0,0 +1,106 @@
+use crate::services::storage::providers::azure_blob::helpers::ResolvedAzure;
+use anyhow::{Result, anyhow};
+use serde::{Deserialize, Serialize};
+use url::Url;
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct AzureBlobProviderConfig {
+    #[serde(default)]
+    pub account_name: String,
+    #[serde(default)]
+    pub account_key: String,
+    pub container_name: String,
+    #[serde(default)]
+    pub auth_mode: Option<String>,
+    #[serde(default)]
+    pub connection_string: String,
+    #[serde(default)]
+    pub endpoint_url: Option<String>,
+}
+
+fn parse_connection_string(cs: &str) -> std::collections::HashMap<String, String> {
+    cs.split(';')
+        .filter(|s| !s.trim().is_empty())
+        .filter_map(|pair| {
+            let mut it = pair.splitn(2, '=');
+            let k = it.next()?.trim().to_string();
+            let v = it.next()?.trim().to_string();
+            Some((k, v))
+        })
+        .collect()
+}
+
+
+pub(crate) fn ensure_account_in_endpoint(endpoint: &str, account: &str) -> String {
+    let trimmed = endpoint.trim_end_matches('/');
+    if account.is_empty() {
+        return trimmed.to_string();
+    }
+    if let Ok(url) = Url::parse(trimmed) {
+        let host = url.host_str().unwrap_or("");
+        if host.contains(account) {
+            return trimmed.to_string();
+        }
+        let path = url.path().trim_matches('/');
+        if path == account || path.starts_with(&format!("{account}/")) {
+            return trimmed.to_string();
+        }
+    }
+    format!("{trimmed}/{account}")
+}
+
+impl AzureBlobProviderConfig {
+    pub fn resolve(&self) -> Result<ResolvedAzure> {
+        let mode = self.auth_mode.as_deref().unwrap_or("").trim();
+        let has_connection_string = !self.connection_string.trim().is_empty();
+
+        if mode == "connectionString" || (mode.is_empty() && has_connection_string) {
+            if !has_connection_string {
+                return Err(anyhow!(
+                    "authMode is connectionString but connectionString is empty"
+                ));
+            }
+            let map = parse_connection_string(&self.connection_string);
+            let account_name = map
+                .get("AccountName")
+                .cloned()
+                .unwrap_or_else(|| self.account_name.clone());
+            let account_key = map
+                .get("AccountKey")
+                .cloned()
+                .unwrap_or_else(|| self.account_key.clone());
+            let blob_endpoint = map
+                .get("BlobEndpoint")
+                .cloned()
+                .ok_or_else(|| anyhow!("connection string missing BlobEndpoint"))?;
+            return Ok(ResolvedAzure {
+                account_name,
+                account_key,
+                blob_endpoint,
+            });
+        }
+
+        if self.account_name.trim().is_empty() {
+            return Err(anyhow!("accountName required for accountKey auth"));
+        }
+        if self.account_key.trim().is_empty() {
+            return Err(anyhow!("accountKey required for accountKey auth"));
+        }
+
+        let blob_endpoint = match self
+            .endpoint_url
+            .as_deref()
+            .map(str::trim)
+            .filter(|s| !s.is_empty())
+        {
+            Some(endpoint) => ensure_account_in_endpoint(endpoint, &self.account_name),
+            None => format!("https://{}.blob.core.windows.net", self.account_name),
+        };
+
+        Ok(ResolvedAzure {
+            account_name: self.account_name.clone(),
+            account_key: self.account_key.clone(),
+            blob_endpoint,
+        })
+    }
+}

src/services/storage/providers/google_cloud_storage/helpers.rs

@@ -0,0 +1,122 @@
+use crate::services::storage::providers::google_cloud_storage::models::GoogleCloudStorageProviderConfig;
+use anyhow::{Context, Result};
+use bytes::Bytes;
+use futures::Stream;
+use futures::StreamExt;
+use google_cloud_auth::credentials::Credentials;
+use google_cloud_storage::client::Storage;
+use google_cloud_storage::streaming_source::{SizeHint, StreamingSource};
+use std::pin::Pin;
+
+pub fn build_credentials(cfg: &GoogleCloudStorageProviderConfig) -> Result<Credentials> {
+    // Service-account JSON stores the PEM with `\n` escape sequences. When the key is
+    // carried through config as a JSON string those can arrive as literal two-char `\n`
+    // sequences rather than real newlines, so the PEM parser finds no `-----BEGIN-----`
+    // line ("no items found"). Normalize them back to real newlines. A PEM that already
+    // has real newlines contains no literal `\n` pairs, so this is a no-op for it.
+    let private_key = cfg.private_key.replace("\\n", "\n");
+
+    let key = serde_json::json!({
+        "type": "service_account",
+        "project_id": cfg.project_id,
+        "client_email": cfg.client_email,
+        "private_key": private_key,
+        "private_key_id": "",
+        "token_uri": "https://oauth2.googleapis.com/token",
+        "universe_domain": "googleapis.com",
+    });
+
+    google_cloud_auth::credentials::service_account::Builder::new(key)
+        .build()
+        .context("failed to build GCS service account credentials")
+}
+
+pub async fn build_client(cfg: &GoogleCloudStorageProviderConfig) -> Result<Storage> {
+    let endpoint = cfg.api_endpoint.as_deref().filter(|s| !s.trim().is_empty());
+
+    // A custom endpoint means a local emulator (fake-gcs-server), which does not verify
+    // credentials. Use anonymous creds so a dummy/empty `private_key` in the emulator
+    // config doesn't trip the service-account PEM parser. Real GCS still uses the
+    // service-account key built from config.
+    let builder = if let Some(ep) = endpoint {
+        let creds = google_cloud_auth::credentials::anonymous::Builder::new().build();
+        Storage::builder()
+            .with_credentials(creds)
+            .with_endpoint(ep.to_string())
+    } else {
+        Storage::builder().with_credentials(build_credentials(cfg)?)
+    };
+
+    builder.build().await.context("failed to build GCS client")
+}
+
+/// Bridges `build_stream`'s `Send`-only byte stream into the SDK's `StreamingSource`
+/// (which `send_buffered` requires to be `Send + Sync + 'static`) via a bounded mpsc
+/// channel. Also reports an exact `size_hint`: the SDK picks single-shot vs resumable
+/// upload from `size_hint().upper()` — an unknown bound forces resumable unconditionally
+/// (see `upload_with_client`).
+pub struct StreamSource {
+    rx: tokio::sync::mpsc::Receiver<Result<Bytes, std::io::Error>>,
+    total_size: u64,
+}
+
+impl StreamSource {
+    pub fn from_stream(
+        mut stream: Pin<Box<dyn Stream<Item = Result<Bytes, std::io::Error>> + Send>>,
+        total_size: u64,
+    ) -> Self {
+        let (tx, rx) = tokio::sync::mpsc::channel(8);
+        tokio::spawn(async move {
+            while let Some(item) = stream.next().await {
+                if tx.send(item).await.is_err() {
+                    break;
+                }
+            }
+        });
+        StreamSource { rx, total_size }
+    }
+}
+
+impl StreamingSource for StreamSource {
+    type Error = std::io::Error;
+    async fn next(&mut self) -> Option<Result<Bytes, Self::Error>> {
+        self.rx.recv().await
+    }
+
+    // Report the exact size so the SDK can choose single-shot uploads. The default
+    // impl returns an unknown bound, which forces the resumable path unconditionally.
+    async fn size_hint(&self) -> Result<SizeHint, Self::Error> {
+        Ok(SizeHint::with_exact(self.total_size))
+    }
+}
+
+pub async fn upload_with_client(
+    client: &Storage,
+    bucket: &str,
+    object: &str,
+    source: StreamSource,
+    force_single_shot: bool,
+) -> Result<()> {
+    // `write_object` uses gRPC-style resource names: the bucket must be passed as
+    // `projects/_/buckets/<name>`, not the bare bucket id.
+    let bucket_resource = format!("projects/_/buckets/{bucket}");
+
+    let mut builder = client.write_object(bucket_resource, object, source);
+
+    // Resumable uploads follow a server-generated `Location` URL. When pointed at a
+    // custom `apiEndpoint` on a non-443 port, the SDK's transport drops the port from
+    // the `Host` header (google-cloud-gax-internal `host.rs`), so emulators that build
+    // the `Location` from `Host` hand back a portless URL the SDK then hangs on. A
+    // single-shot upload issues one request to the configured endpoint (no `Location`
+    // to follow), sidestepping the bug. We force it only for custom endpoints; against
+    // real GCS we keep resumable (bounded memory + resume on large backups).
+    if force_single_shot {
+        builder = builder.with_resumable_upload_threshold(usize::MAX);
+    }
+
+    builder
+        .send_buffered()
+        .await
+        .context("GCS write_object failed")?;
+    Ok(())
+}

src/services/storage/providers/google_cloud_storage/mod.rs

@@ -0,0 +1,148 @@
+pub mod helpers;
+mod models;
+
+use crate::core::context::Context;
+use crate::services::api::models::agent::status::DatabaseStorage;
+use crate::services::backup::models::{BackupResult, UploadResult};
+use crate::services::storage::StorageProvider;
+use crate::services::storage::providers::google_cloud_storage::helpers::{
+    StreamSource, build_client, upload_with_client,
+};
+use crate::services::storage::providers::google_cloud_storage::models::GoogleCloudStorageProviderConfig;
+use crate::utils::common::BackupMethod;
+use crate::utils::file::{full_file_name, full_file_path};
+use crate::utils::stream::build_stream;
+use async_trait::async_trait;
+use std::sync::Arc;
+use tokio::fs;
+use tracing::{error, info};
+
+pub struct GoogleCloudStorageProvider {}
+
+#[async_trait]
+impl StorageProvider for GoogleCloudStorageProvider {
+    async fn upload(
+        &self,
+        ctx: Arc<Context>,
+        result: BackupResult,
+        _method: BackupMethod,
+        storage: &DatabaseStorage,
+        encrypt: Option<bool>,
+    ) -> UploadResult {
+        let Some(file_path) = result.backup_file else {
+            return UploadResult {
+                storage_id: storage.id.clone(),
+                success: false,
+                error: Some("Missing backup file path".to_string()),
+                remote_file_path: None,
+                total_size: None,
+            };
+        };
+
+        let total_size = match fs::metadata(&file_path).await {
+            Ok(meta) => meta.len(),
+            Err(e) => {
+                error!("Failed to get file size: {}", e);
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let encrypt = encrypt.unwrap_or(false);
+
+        let upload = match build_stream(&file_path, encrypt, &ctx.edge_key.master_key_b64).await {
+            Ok(u) => u,
+            Err(e) => {
+                error!("Stream build failed: {}", e);
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let config: GoogleCloudStorageProviderConfig = match storage.clone().config.try_into() {
+            Ok(c) => c,
+            Err(e) => {
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let file_name = full_file_name(encrypt);
+        info!("Uploading file {}", file_name);
+        let remote_file_path = full_file_path(&file_name);
+
+        let client = match build_client(&config).await {
+            Ok(c) => c,
+            Err(e) => {
+                error!("GCS client build failed: {:?}", e);
+                return UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: None,
+                };
+            }
+        };
+
+        let source = StreamSource::from_stream(upload.stream, total_size);
+
+        // A custom apiEndpoint (self-hosted / emulator) on a non-443 port trips an
+        // upstream SDK bug in the resumable-upload path; force single-shot for it.
+        let force_single_shot = config
+            .api_endpoint
+            .as_deref()
+            .is_some_and(|s| !s.trim().is_empty());
+
+        info!(
+            "Starting GCS upload to {}/{} (single_shot={})",
+            config.bucket_name, remote_file_path, force_single_shot
+        );
+
+        match upload_with_client(
+            &client,
+            &config.bucket_name,
+            &remote_file_path,
+            source,
+            force_single_shot,
+        )
+        .await
+        {
+            Ok(_) => {
+                info!("GCS upload successful: {}", remote_file_path);
+                UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: true,
+                    error: None,
+                    remote_file_path: Some(remote_file_path),
+                    total_size: Some(total_size),
+                }
+            }
+            Err(e) => {
+                error!("GCS upload failed: {:?}", e);
+                UploadResult {
+                    storage_id: storage.id.clone(),
+                    success: false,
+                    error: Some(e.to_string()),
+                    remote_file_path: None,
+                    total_size: Some(total_size),
+                }
+            }
+        }
+    }
+}

src/services/storage/providers/google_cloud_storage/models.rs

@@ -0,0 +1,11 @@
+use serde::{Deserialize, Serialize};
+
+#[derive(Debug, Deserialize, Serialize)]
+pub struct GoogleCloudStorageProviderConfig {
+    pub project_id: String,
+    pub bucket_name: String,
+    pub client_email: String,
+    pub private_key: String,
+    #[serde(default)]
+    pub api_endpoint: Option<String>,
+}

src/services/storage/providers/mod.rs

@@ -1,3 +1,5 @@
+pub mod azure_blob;
+pub mod google_cloud_storage;
 pub mod google_drive;
 pub mod local;
 pub mod s3;

src/settings.rs

@@ -11,6 +11,7 @@ pub struct Settings {
     pub edge_key: String,
     pub databases_config_file: String,
     pub data_path: String,
+    pub pg_bin_dir: String,
     pub pooling: usize,
     pub timezone: String,
     pub log: String,
@@ -59,6 +60,7 @@ impl Settings {
             databases_config_file: env::var("DATABASES_CONFIG_FILE")
                 .unwrap_or_else(|_| "config.json".into()),
             data_path: env::var("DATA_PATH").unwrap_or_else(|_| "/config".into()),
+            pg_bin_dir: env::var("PG_BIN_DIR").unwrap_or_default(),
             pooling: pooling_seconds,
             timezone: tz,
             log: env::var("LOG").unwrap_or_else(|_| "info".into()),

src/tests/domain/cluster/backup.rs

@@ -0,0 +1,53 @@
+use super::{env_for, start_cluster};
+use crate::domain::postgres::{cluster, connection};
+use crate::services::backup::logger::JobLogger;
+use crate::tests::init_tracing_for_test;
+use std::sync::Arc;
+use tempfile::TempDir;
+
+#[tokio::test]
+async fn produces_sql_with_roles_and_databases() {
+    init_tracing_for_test();
+    let (_c, cfg) = start_cluster("testuser").await;
+
+    let dir = TempDir::new().unwrap();
+    let logger = Arc::new(JobLogger::new());
+    let sql = cluster::backup::run(cfg.clone(), dir.path().to_path_buf(), env_for(&cfg), logger)
+        .await
+        .unwrap();
+
+    assert!(sql.is_file());
+    let contents = std::fs::read_to_string(&sql).unwrap();
+    assert!(contents.contains("CREATE ROLE"), "expected CREATE ROLE in dump");
+    assert!(
+        contents.contains("CREATE DATABASE") || contents.contains("\\connect"),
+        "expected database statements in dump"
+    );
+}
+
+#[tokio::test]
+async fn requires_superuser() {
+    init_tracing_for_test();
+    let (_c, super_cfg) = start_cluster("testuser").await;
+
+    // Create a NON-superuser login role on the cluster.
+    let client = connection::connect(&super_cfg).await.unwrap();
+    client
+        .batch_execute("CREATE ROLE appuser LOGIN PASSWORD 'changeme' NOSUPERUSER;")
+        .await
+        .unwrap();
+
+    let mut weak = super_cfg.clone();
+    weak.username = "appuser".to_string();
+
+    let dir = TempDir::new().unwrap();
+    let logger = Arc::new(JobLogger::new());
+    let err = cluster::backup::run(weak.clone(), dir.path().to_path_buf(), env_for(&weak), logger)
+        .await
+        .unwrap_err();
+
+    assert!(
+        err.to_string().contains("superuser"),
+        "expected a superuser error, got: {err}"
+    );
+}

src/tests/domain/cluster/database.rs

@@ -0,0 +1,31 @@
+use crate::domain::factory::DatabaseFactory;
+use crate::services::config::{DatabaseConfig, DbType};
+use std::path::Path;
+
+fn cluster_config() -> DatabaseConfig {
+    DatabaseConfig {
+        name: "cluster".to_string(),
+        database: "postgres".to_string(),
+        db_type: DbType::PostgresqlCluster,
+        username: "postgres".to_string(),
+        password: "changeme".to_string(),
+        port: 5432,
+        host: "localhost".to_string(),
+        generated_id: "40875631-e3d2-4dfe-a26b-2a347ecc64fd".to_string(),
+        path: String::new(),
+        max_packet_size: String::new(),
+        options: std::collections::HashMap::new(),
+    }
+}
+
+#[tokio::test]
+async fn factory_routes_cluster_for_backup_with_sql_extension() {
+    let db = DatabaseFactory::create_for_backup(cluster_config()).await;
+    assert_eq!(db.file_extension(), ".sql");
+}
+
+#[tokio::test]
+async fn factory_routes_cluster_for_restore_with_sql_extension() {
+    let db = DatabaseFactory::create_for_restore(cluster_config(), Path::new("dump.sql")).await;
+    assert_eq!(db.file_extension(), ".sql");
+}

src/tests/domain/cluster/mod.rs

@@ -0,0 +1,48 @@
+mod backup;
+mod database;
+mod restore;
+
+use crate::services::config::{DatabaseConfig, DbType};
+use std::collections::HashMap;
+use testcontainers::runners::AsyncRunner;
+use testcontainers::{ContainerAsync, ImageExt};
+use testcontainers_modules::postgres::Postgres;
+use url::Host;
+
+async fn start_cluster(user: &str) -> (ContainerAsync<Postgres>, DatabaseConfig) {
+    let container = Postgres::default()
+        .with_env_var("POSTGRES_DB", "postgres")
+        .with_env_var("POSTGRES_USER", user)
+        .with_env_var("POSTGRES_PASSWORD", "changeme")
+        .with_tag("17")
+        .start()
+        .await
+        .unwrap();
+
+    let host = container
+        .get_host()
+        .await
+        .unwrap_or(Host::parse("127.0.0.1").unwrap());
+    let port = container.get_host_port_ipv4(5432).await.unwrap_or(5432);
+
+    let config = DatabaseConfig {
+        name: format!("cluster-{}", user),
+        database: "postgres".to_string(),
+        db_type: DbType::PostgresqlCluster,
+        username: user.to_string(),
+        password: "changeme".to_string(),
+        port,
+        host: host.to_string(),
+        generated_id: "40875631-e3d2-4dfe-a26b-2a347ecc64fd".to_string(),
+        path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
+    };
+    (container, config)
+}
+
+fn env_for(cfg: &DatabaseConfig) -> HashMap<String, String> {
+    let mut env = std::env::vars().collect::<HashMap<_, _>>();
+    env.insert("PGPASSWORD".to_string(), cfg.password.clone());
+    env
+}

src/tests/domain/cluster/restore.rs

@@ -0,0 +1,83 @@
+use super::{env_for, start_cluster};
+use crate::domain::postgres::{cluster, connection};
+use crate::services::backup::logger::JobLogger;
+use crate::tests::init_tracing_for_test;
+use std::sync::Arc;
+use tempfile::TempDir;
+
+#[tokio::test]
+async fn backup_restore_round_trip_preserves_ownership() {
+    init_tracing_for_test();
+
+    // Source cluster A: seed a role + a table owned by that role.
+    let (_a, src) = start_cluster("testuser").await;
+    let client = connection::connect(&src).await.unwrap();
+    client
+        .batch_execute(
+            "CREATE ROLE appowner LOGIN PASSWORD 'changeme' NOSUPERUSER;\n\
+             CREATE TABLE owned_tbl (id int);\n\
+             ALTER TABLE owned_tbl OWNER TO appowner;",
+        )
+        .await
+        .unwrap();
+
+    let dir = TempDir::new().unwrap();
+    let sql = cluster::backup::run(src.clone(), dir.path().to_path_buf(), env_for(&src), Arc::new(JobLogger::new()))
+        .await
+        .unwrap();
+
+    // Target cluster B: fresh, same bootstrap user.
+    let (_b, mut dst) = start_cluster("testuser").await;
+
+    cluster::restore::run(dst.clone(), sql.clone(), env_for(&dst), Arc::new(JobLogger::new()))
+        .await
+        .unwrap();
+
+    // Verify the seeded role exists and the table's owner was preserved on B.
+    dst.database = "postgres".to_string();
+    let bclient = connection::connect(&dst).await.unwrap();
+    let role_exists: bool = bclient
+        .query_one("SELECT EXISTS (SELECT 1 FROM pg_roles WHERE rolname = 'appowner');", &[])
+        .await
+        .unwrap()
+        .get(0);
+    assert!(role_exists, "appowner role must be recreated on the target");
+
+    let owner: String = bclient
+        .query_one(
+            "SELECT tableowner FROM pg_tables WHERE tablename = 'owned_tbl';",
+            &[],
+        )
+        .await
+        .unwrap()
+        .get(0);
+    assert_eq!(owner, "appowner", "table ownership must be preserved");
+}
+
+#[tokio::test]
+async fn requires_superuser() {
+    init_tracing_for_test();
+    let (_c, super_cfg) = start_cluster("testuser").await;
+
+    // A non-superuser login role must be rejected before psql runs.
+    let client = connection::connect(&super_cfg).await.unwrap();
+    client
+        .batch_execute("CREATE ROLE appuser LOGIN PASSWORD 'changeme' NOSUPERUSER;")
+        .await
+        .unwrap();
+
+    let mut weak = super_cfg.clone();
+    weak.username = "appuser".to_string();
+
+    // The superuser pre-check happens before the dump file is read, so a
+    // non-existent restore path is fine — it must never be touched.
+    let missing = std::path::PathBuf::from("/nonexistent/cluster.sql");
+    let err = cluster::restore::run(weak.clone(), missing, env_for(&weak), Arc::new(JobLogger::new()))
+        .await
+        .unwrap_err();
+
+    assert!(
+        err.to_string().contains("superuser"),
+        "expected a superuser error, got: {err}"
+    );
+}

src/tests/domain/firebird.rs

@@ -39,6 +39,8 @@ async fn create_config() -> (ContainerAsync<GenericImage>, DatabaseConfig) {
         host,
         generated_id: "3c445eb4-c2c6-4bde-a423-ee1385dcf6d2".to_string(),
         path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
     };
 
     (container, config)

src/tests/domain/mariadb.rs

@@ -31,6 +31,8 @@ async fn create_config() -> (ContainerAsync<Mariadb>, DatabaseConfig) {
         host: host.to_string(),
         generated_id: "3c4b4eb4-c2c6-4bde-a423-ee1385dcf6d2".to_string(),
         path: "".to_string(),
+        max_packet_size: "512M".to_string(),
+        options: std::collections::HashMap::new(),
     };
 
     (container, config)

src/tests/domain/mod.rs

@@ -2,6 +2,7 @@ mod mariadb;
 mod mongodb;
 mod mysql;
 mod postgres;
+mod cluster;
 mod redis;
 mod valkey;
 mod firebird;

src/tests/domain/mongodb.rs

@@ -29,6 +29,8 @@ async fn create_config() -> (ContainerAsync<Mongo>, DatabaseConfig) {
         host: host.to_string(),
         generated_id: "96d30a9f-ff4b-47c9-aaab-f3147bb34f16".to_string(),
         path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
     };
 
     (container, config)

src/tests/domain/mssql.rs

@@ -54,6 +54,8 @@ fn make_config(host: String, port: u16, database: &str, generated_id: &str) -> D
         host,
         generated_id: generated_id.to_string(),
         path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
     }
 }
 

src/tests/domain/mysql.rs

@@ -31,6 +31,8 @@ async fn create_config() -> (ContainerAsync<Mysql>, DatabaseConfig) {
         host: host.to_string(),
         generated_id: "0f1bb8f2-35a0-4c91-8098-e36873d3ce31".to_string(),
         path: "".to_string(),
+        max_packet_size: "512M".to_string(),
+        options: std::collections::HashMap::new(),
     };
 
     (container, config)

src/tests/domain/postgres.rs

@@ -38,6 +38,8 @@ async fn create_config() -> (ContainerAsync<Postgres>, DatabaseConfig) {
         host: host.to_string(),
         generated_id: "40875631-e3d2-4dfe-a26b-2a347ecc64fd".to_string(),
         path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
     };
 
     (container, config)
@@ -55,6 +57,20 @@ async fn postgres_ping_test() {
     assert_eq!(reachable, true);
 }
 
+#[tokio::test]
+async fn is_superuser_detects_superuser_role() {
+    init_tracing_for_test();
+
+    // The testcontainer's POSTGRES_USER ("testuser") is the bootstrap superuser.
+    let (_container, config) = create_config().await;
+
+    let is_super = crate::domain::postgres::connection::is_superuser(&config)
+        .await
+        .unwrap();
+
+    assert!(is_super);
+}
+
 #[tokio::test]
 async fn postgres_backup_restore_test() {
     init_tracing_for_test();
@@ -107,3 +123,127 @@ async fn postgres_backup_restore_test() {
         }
     }
 }
+
+#[tokio::test]
+async fn postgres_password_with_slash_test() {
+    init_tracing_for_test();
+
+    let special_password = "ch/ange:me@1";
+
+    let container = Postgres::default()
+        .with_env_var("POSTGRES_DB", "testdb")
+        .with_env_var("POSTGRES_USER", "testuser")
+        .with_env_var("POSTGRES_PASSWORD", special_password)
+        .with_tag("17")
+        .start()
+        .await
+        .unwrap();
+
+    let host = container
+        .get_host()
+        .await
+        .unwrap_or(Host::parse("127.0.0.1").unwrap());
+
+    let port = container.get_host_port_ipv4(5432).await.unwrap_or(5432);
+
+    let config = DatabaseConfig {
+        name: "My test Postgres Database with slash password".to_string(),
+        database: "testdb".to_string(),
+        db_type: DbType::Postgresql,
+        username: "testuser".to_string(),
+        password: special_password.to_string(),
+        port,
+        host: host.to_string(),
+        generated_id: "5a1f0e3c-9b8a-4a8e-9b1b-0a1c2d3e4f5a".to_string(),
+        path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
+    };
+
+    let db = DatabaseFactory::create_for_backup(config.clone()).await;
+    let reachable = db.ping().await.unwrap_or(false);
+
+    assert_eq!(reachable, true);
+}
+
+mod select_pg_path_tests {
+    use crate::domain::postgres::connection::{
+        pg_dump_binary_name, pg_dump_exists_in, pg_dumpall_binary_name, psql_binary_name,
+        select_pg_path_with,
+    };
+
+    // `select_pg_path_with` takes the `PG_BIN_DIR` override as a plain
+    // argument, so these tests never touch process-global env state or the
+    // cached `CONFIG`. They stay deterministic regardless of whether — or at
+    // which version — a real PostgreSQL install exists on the host.
+
+    #[test]
+    fn respects_pg_bin_dir_override() {
+        let custom = if cfg!(target_os = "windows") {
+            r"C:\custom\pg\bin"
+        } else {
+            "/custom/pg/bin"
+        };
+        let path = select_pg_path_with("16.4", custom);
+        assert_eq!(path, std::path::PathBuf::from(custom));
+    }
+
+    #[test]
+    fn pg_bin_dir_override_ignores_requested_version() {
+        // The override is taken as-is, regardless of which version was
+        // requested — this documents/locks in that behavior.
+        let custom = if cfg!(target_os = "windows") {
+            r"C:\custom\pg\bin"
+        } else {
+            "/custom/pg/bin"
+        };
+        let path = select_pg_path_with("not-a-version", custom);
+        assert_eq!(path, std::path::PathBuf::from(custom));
+    }
+
+    #[test]
+    fn empty_pg_bin_dir_falls_through_to_detection() {
+        // An empty override means "unset" (matches `CONFIG.pg_bin_dir` when
+        // `PG_BIN_DIR` is absent). It must not be returned as a literal empty
+        // path — resolution falls through to platform defaults / PATH lookup
+        // and yields a non-empty path.
+        let path = select_pg_path_with("17", "");
+        assert_ne!(path, std::path::PathBuf::from(""));
+    }
+
+    #[test]
+    fn pg_dump_binary_name_is_platform_specific() {
+        let name = pg_dump_binary_name();
+        if cfg!(target_os = "windows") {
+            assert_eq!(name, "pg_dump.exe");
+        } else {
+            assert_eq!(name, "pg_dump");
+        }
+    }
+
+    #[test]
+    fn pg_dump_exists_in_is_false_for_nonexistent_dir() {
+        let dir = std::path::Path::new("this/path/almost-certainly/does-not-exist-12345");
+        assert!(!pg_dump_exists_in(dir));
+    }
+
+    #[test]
+    fn pg_dumpall_binary_name_is_platform_specific() {
+        let name = pg_dumpall_binary_name();
+        if cfg!(target_os = "windows") {
+            assert_eq!(name, "pg_dumpall.exe");
+        } else {
+            assert_eq!(name, "pg_dumpall");
+        }
+    }
+
+    #[test]
+    fn psql_binary_name_is_platform_specific() {
+        let name = psql_binary_name();
+        if cfg!(target_os = "windows") {
+            assert_eq!(name, "psql.exe");
+        } else {
+            assert_eq!(name, "psql");
+        }
+    }
+}

src/tests/domain/redis.rs

@@ -28,6 +28,8 @@ async fn create_config() -> (ContainerAsync<Redis>, DatabaseConfig) {
         host: host.to_string(),
         generated_id: "40875631-e3d2-4dfe-a26b-2a347ecc64fd".to_string(),
         path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
     };
 
     (container, config)

src/tests/domain/valkey.rs

@@ -27,6 +27,8 @@ async fn create_config() -> (ContainerAsync<Valkey>, DatabaseConfig) {
         host: host.to_string(),
         generated_id: "40875485-e3d2-4dfe-a26b-2a347ecc64fd".to_string(),
         path: "".to_string(),
+        max_packet_size: "".to_string(),
+        options: std::collections::HashMap::new(),
     };
 
     (container, config)

src/tests/mod.rs

@@ -1,5 +1,6 @@
 mod domain;
 mod services;
+mod storage;
 mod utils;
 
 use once_cell::sync::Lazy;

src/tests/services/backup_uploader_tests.rs

@@ -0,0 +1,95 @@
+//! Regression test: a per-storage upload failure must be reported to the server via
+//! `backup_upload_status("failed", ...)`. Previously the uploader early-returned on failure
+//! and skipped the status call, so `backup_upload_init` opened a record that was never closed.
+
+use crate::core::context::Context;
+use crate::services::api::ApiClient;
+use crate::services::api::models::agent::status::DatabaseStorage;
+use crate::services::backup::BackupService;
+use crate::services::backup::logger::JobLogger;
+use crate::services::backup::models::BackupResult;
+use crate::services::config::DbType;
+use crate::tests::init_tracing_for_test;
+use crate::utils::common::BackupMethod;
+use crate::utils::edge_key::EdgeKey;
+
+use serde_json::json;
+use std::sync::Arc;
+use wiremock::matchers::{body_partial_json, method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+fn ctx_pointing_at(base_url: String) -> Context {
+    Context {
+        edge_key: EdgeKey {
+            server_url: String::new(),
+            agent_id: "agent-1".to_string(),
+            master_key_b64: String::new(),
+        },
+        api: ApiClient::new(base_url),
+    }
+}
+
+#[tokio::test]
+async fn failed_upload_reports_failed_status_to_server() {
+    init_tracing_for_test();
+    let server = MockServer::start().await;
+
+    // init opens the per-storage record and returns its id.
+    Mock::given(method("POST"))
+        .and(path("/agent/agent-1/backup/upload/init"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "message": "ok",
+            "backupStorage": { "id": "bs-1" }
+        })))
+        .expect(1)
+        .mount(&server)
+        .await;
+
+    // The fix: on failure the uploader must PATCH the status as "failed".
+    Mock::given(method("PATCH"))
+        .and(path("/agent/agent-1/backup/upload/status"))
+        .and(body_partial_json(json!({ "status": "failed" })))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({})))
+        .expect(1)
+        .mount(&server)
+        .await;
+
+    let service = BackupService::new(Arc::new(ctx_pointing_at(server.uri())));
+
+    // backup_file = None makes the provider fail immediately ("Missing backup file path"),
+    // exercising the failure path without any network/Azure dependency.
+    let result = BackupResult {
+        generated_id: "gen-1".to_string(),
+        db_type: DbType::Postgresql,
+        status: "success".to_string(),
+        backup_file: None,
+        code: None,
+    };
+
+    let storage: DatabaseStorage = serde_json::from_value(json!({
+        "id": "storage-1",
+        "provider": "blob",
+        "config": {}
+    }))
+    .unwrap();
+
+    let backup_id = "backup-1".to_string();
+    let logger = Arc::new(JobLogger::new());
+
+    let results = service
+        .upload(
+            result,
+            BackupMethod::Manual,
+            vec![storage],
+            false,
+            &backup_id,
+            logger,
+        )
+        .await
+        .unwrap();
+
+    assert_eq!(results.len(), 1);
+    assert!(!results[0].success);
+
+    // MockServer drop verifies both `.expect(1)` mounts were hit — including the "failed" PATCH.
+}

src/tests/services/config_tests.rs

@@ -0,0 +1,201 @@
+use crate::core::context::Context;
+use crate::services::api::ApiClient;
+use crate::services::config::ConfigService;
+use crate::utils::edge_key::EdgeKey;
+use std::io::Write;
+use std::sync::Arc;
+use tempfile::NamedTempFile;
+
+// `ConfigService::load` never touches `self.ctx` on the `Some(file_path)` path,
+// so the values here don't matter — but `Context::new()` panics without an
+// `EDGE_KEY` env var, so build the struct directly (mirrors
+// backup_uploader_tests.rs's `ctx_pointing_at`).
+fn test_context() -> Arc<Context> {
+    Arc::new(Context {
+        edge_key: EdgeKey {
+            server_url: String::new(),
+            agent_id: "agent-1".to_string(),
+            master_key_b64: String::new(),
+        },
+        api: ApiClient::new(String::new()),
+    })
+}
+
+fn write_json(contents: &str) -> NamedTempFile {
+    let mut file = NamedTempFile::with_suffix(".json").unwrap();
+    file.write_all(contents.as_bytes()).unwrap();
+    file
+}
+
+#[test]
+fn parses_postgresql_cluster_type() {
+    let file = write_json(
+        r#"{
+            "databases": [
+                {
+                    "name": "cluster1",
+                    "type": "postgresql-cluster",
+                    "username": "postgres",
+                    "password": "p",
+                    "port": 5432,
+                    "host": "localhost",
+                    "generated_id": "16678159-ff7e-4c97-8c83-0adeff214681"
+                }
+            ]
+        }"#,
+    );
+
+    let service = ConfigService::new(test_context());
+    let cfg = service.load(Some(file.path().to_str().unwrap())).unwrap();
+
+    assert_eq!(cfg.databases[0].db_type.as_str(), "postgresql-cluster");
+    // `database` is optional for cluster entries and defaults to "postgres".
+    assert_eq!(cfg.databases[0].database, "postgres");
+}
+
+#[test]
+fn postgresql_cluster_respects_explicit_database() {
+    let file = write_json(
+        r#"{
+            "databases": [
+                {
+                    "name": "cluster1",
+                    "type": "postgresql-cluster",
+                    "database": "maintenance",
+                    "username": "postgres",
+                    "password": "p",
+                    "port": 5432,
+                    "host": "localhost",
+                    "generated_id": "16678159-ff7e-4c97-8c83-0adeff214681"
+                }
+            ]
+        }"#,
+    );
+
+    let service = ConfigService::new(test_context());
+    let cfg = service.load(Some(file.path().to_str().unwrap())).unwrap();
+
+    assert_eq!(cfg.databases[0].database, "maintenance");
+}
+
+#[test]
+fn postgresql_options_keep_ownership_parses() {
+    let file = write_json(
+        r#"{
+            "databases": [
+                {
+                    "name": "db1",
+                    "type": "postgresql",
+                    "username": "u",
+                    "password": "p",
+                    "port": 5432,
+                    "host": "localhost",
+                    "database": "mydb",
+                    "generated_id": "16678159-ff7e-4c97-8c83-0adeff214681",
+                    "options": {
+                        "keep_ownership": true
+                    }
+                }
+            ]
+        }"#,
+    );
+
+    let service = ConfigService::new(test_context());
+    let cfg = service.load(Some(file.path().to_str().unwrap())).unwrap();
+
+    let keep = cfg.databases[0]
+        .options
+        .get("keep_ownership")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+
+    assert!(keep);
+}
+
+#[test]
+fn postgresql_options_absent_defaults_to_empty() {
+    let file = write_json(
+        r#"{
+            "databases": [
+                {
+                    "name": "db1",
+                    "type": "postgresql",
+                    "username": "u",
+                    "password": "p",
+                    "port": 5432,
+                    "host": "localhost",
+                    "database": "mydb",
+                    "generated_id": "16678159-ff7e-4c97-8c83-0adeff214681"
+                }
+            ]
+        }"#,
+    );
+
+    let service = ConfigService::new(test_context());
+    let cfg = service.load(Some(file.path().to_str().unwrap())).unwrap();
+
+    assert!(cfg.databases[0].options.is_empty());
+}
+
+#[test]
+fn postgresql_options_non_bool_keep_ownership_falls_back_to_false() {
+    let file = write_json(
+        r#"{
+            "databases": [
+                {
+                    "name": "db1",
+                    "type": "postgresql",
+                    "username": "u",
+                    "password": "p",
+                    "port": 5432,
+                    "host": "localhost",
+                    "database": "mydb",
+                    "generated_id": "16678159-ff7e-4c97-8c83-0adeff214681",
+                    "options": {
+                        "keep_ownership": "yes"
+                    }
+                }
+            ]
+        }"#,
+    );
+
+    let service = ConfigService::new(test_context());
+    let cfg = service.load(Some(file.path().to_str().unwrap())).unwrap();
+
+    let keep = cfg.databases[0]
+        .options
+        .get("keep_ownership")
+        .and_then(|v| v.as_bool())
+        .unwrap_or(false);
+
+    assert!(!keep);
+}
+
+#[test]
+fn keep_ownership_extraction_logic() {
+    use serde_json::Value;
+    use std::collections::HashMap;
+
+    // true → keep ownership
+    let mut opts: HashMap<String, Value> = HashMap::new();
+    opts.insert("keep_ownership".to_string(), Value::Bool(true));
+    let keep = opts.get("keep_ownership").and_then(|v| v.as_bool()).unwrap_or(false);
+    assert!(keep, "should keep ownership when flag is true");
+
+    // false → strip
+    let mut opts2: HashMap<String, Value> = HashMap::new();
+    opts2.insert("keep_ownership".to_string(), Value::Bool(false));
+    let keep2 = opts2.get("keep_ownership").and_then(|v| v.as_bool()).unwrap_or(false);
+    assert!(!keep2, "should strip when flag is false");
+
+    // missing → strip
+    let opts3: HashMap<String, Value> = HashMap::new();
+    let keep3 = opts3.get("keep_ownership").and_then(|v| v.as_bool()).unwrap_or(false);
+    assert!(!keep3, "should strip when key absent");
+
+    // wrong type → strip
+    let mut opts4: HashMap<String, Value> = HashMap::new();
+    opts4.insert("keep_ownership".to_string(), Value::String("yes".to_string()));
+    let keep4 = opts4.get("keep_ownership").and_then(|v| v.as_bool()).unwrap_or(false);
+    assert!(!keep4, "should strip when value is not bool");
+}

src/tests/services/mod.rs

@@ -1 +1,3 @@
 mod api_models_tests;
+mod backup_uploader_tests;
+mod config_tests;

src/tests/storage/azure_blob.rs

@@ -0,0 +1,241 @@
+use crate::services::storage::providers::azure_blob::helpers::{
+    ResolvedAzure, SAS_VERSION, SasResource, build_sas_url, hmac_sha256_b64,
+};
+use crate::tests::init_tracing_for_test;
+
+use anyhow::{Context as _, anyhow};
+use azure_core::http::RequestContent;
+use azure_storage_blob::clients::BlobClient;
+use azure_storage_blob::models::BlockLookupList;
+use base64::Engine;
+use base64::engine::general_purpose::STANDARD;
+use bytes::Bytes;
+use chrono::{Duration, Utc};
+use testcontainers::core::{IntoContainerPort, WaitFor};
+use testcontainers::runners::AsyncRunner;
+use testcontainers::{GenericImage, ImageExt};
+use url::Url;
+
+
+fn build_account_sas(
+    resolved: &ResolvedAzure,
+    services: &str,
+    resource_types: &str,
+    permissions: &str,
+) -> anyhow::Result<Vec<(String, String)>> {
+    let key = STANDARD
+        .decode(&resolved.account_key)
+        .map_err(|_| anyhow!("account key is not valid base64"))?;
+
+    let signed_start = String::new();
+    let signed_expiry = (Utc::now() + Duration::hours(1))
+        .format("%Y-%m-%dT%H:%M:%SZ")
+        .to_string();
+    let signed_protocol = "https,http";
+    let signed_ip = String::new();
+    let encryption_scope = String::new();
+    let string_to_sign = format!(
+        "{acc}\n{sp}\n{ss}\n{srt}\n{st}\n{se}\n{sip}\n{spr}\n{sv}\n{ses}\n",
+        acc = resolved.account_name, sp = permissions, ss = services, srt = resource_types,
+        st = signed_start, se = signed_expiry, sip = signed_ip, spr = signed_protocol,
+        sv = SAS_VERSION, ses = encryption_scope,
+    );
+
+    let sig = hmac_sha256_b64(&key, &string_to_sign)?;
+
+    Ok(vec![
+        ("sv".into(), SAS_VERSION.into()),
+        ("ss".into(), services.into()),
+        ("srt".into(), resource_types.into()),
+        ("sp".into(), permissions.into()),
+        ("se".into(), signed_expiry),
+        ("spr".into(), signed_protocol.into()),
+        ("sig".into(), sig),
+    ])
+}
+
+fn build_account_sas_container_url(
+    resolved: &ResolvedAzure,
+    container: &str,
+    services: &str,
+    resource_types: &str,
+    permissions: &str,
+) -> anyhow::Result<Url> {
+    let pairs = build_account_sas(resolved, services, resource_types, permissions)?;
+    let base = format!("{}/{}", resolved.blob_endpoint.trim_end_matches('/'), container);
+    let mut url = Url::parse(&base).context("invalid blob endpoint/url")?;
+    {
+        let mut qp = url.query_pairs_mut();
+        for (k, v) in pairs {
+            qp.append_pair(&k, &v);
+        }
+    }
+    Ok(url)
+}
+
+const AZURITE_ACCOUNT: &str = "devstoreaccount1";
+const AZURITE_KEY: &str =
+    "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";
+
+async fn start_azurite() -> (testcontainers::ContainerAsync<GenericImage>, ResolvedAzure) {
+    let container = GenericImage::new("mcr.microsoft.com/azure-storage/azurite", "latest")
+        .with_exposed_port(10000.tcp())
+        .with_wait_for(WaitFor::message_on_stdout(
+            "Azurite Blob service successfully listens on",
+        ))
+        .with_cmd(["azurite-blob", "--blobHost", "0.0.0.0", "--skipApiVersionCheck"])
+        .start().await.unwrap();
+
+    let host = container.get_host().await.unwrap().to_string();
+    let port = container.get_host_port_ipv4(10000).await.unwrap();
+    let resolved = ResolvedAzure {
+        account_name: AZURITE_ACCOUNT.to_string(),
+        account_key: AZURITE_KEY.to_string(),
+        blob_endpoint: format!("http://{host}:{port}/{AZURITE_ACCOUNT}"),
+    };
+    (container, resolved)
+}
+
+#[tokio::test]
+async fn spike_sas_block_roundtrip_against_azurite() {
+    init_tracing_for_test();
+    let (_container, resolved) = start_azurite().await;
+    let container = "portabase";
+    let blob = "spike/hello.txt";
+
+
+    let container_url =
+        build_account_sas_container_url(&resolved, container, "b", "c", "cw").unwrap();
+    let container_client =
+        azure_storage_blob::clients::BlobContainerClient::new(container_url, None, None).unwrap();
+    container_client.create(None).await.unwrap();
+
+    let blob_url = build_sas_url(&resolved, container, blob, SasResource::Blob, "cw").unwrap();
+    let blob_client = BlobClient::new(blob_url.clone(), None, None).unwrap();
+    let bbc = blob_client.block_blob_client();
+
+    let payload = Bytes::from_static(b"hello azurite");
+    let raw_id = format!("{:032}", 0u32).into_bytes();
+    bbc.stage_block(&raw_id, payload.len() as u64, RequestContent::from(payload.to_vec()), None)
+        .await.unwrap();
+
+    let block_list = BlockLookupList { latest: Some(vec![raw_id.clone()]), ..Default::default() };
+    bbc.commit_block_list(block_list.try_into().unwrap(), None).await.unwrap();
+
+    let read_url = build_sas_url(&resolved, container, blob, SasResource::Blob, "r").unwrap();
+    let read_client = BlobClient::new(read_url, None, None).unwrap();
+    assert!(read_client.exists().await.unwrap());
+}
+
+mod resolve {
+    use crate::services::storage::providers::azure_blob::models::{
+        AzureBlobProviderConfig, ensure_account_in_endpoint,
+    };
+
+    const AZURITE_KEY: &str =
+        "Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==";
+    const CONNECTION_STRING: &str = "DefaultEndpointsProtocol=http;AccountName=devstoreaccount1;AccountKey=Eby8vdM02xNOcqFlqUwJPLlmEtlCDXJ1OUzFT50uSRZ6IFsuFq2UVErCz4I6tq/K1SZFPTOtr/KBHBeksoGMGw==;BlobEndpoint=http://localhost:10000/devstoreaccount1;QueueEndpoint=http://localhost:10001/devstoreaccount1;TableEndpoint=http://localhost:10002/devstoreaccount1;";
+
+
+    #[test]
+    fn resolve_connection_string_mode() {
+        let cfg = AzureBlobProviderConfig {
+            account_name: String::new(),
+            account_key: String::new(),
+            container_name: "portabase".into(),
+            auth_mode: Some("connectionString".into()),
+            connection_string: CONNECTION_STRING.into(),
+            endpoint_url: None,
+        };
+        let r = cfg.resolve().unwrap();
+        assert_eq!(r.account_name, "devstoreaccount1");
+        assert_eq!(r.account_key, AZURITE_KEY);
+        assert_eq!(r.blob_endpoint, "http://localhost:10000/devstoreaccount1");
+    }
+
+
+    #[test]
+    fn resolve_account_key_mode_injects_account_path() {
+        let cfg = AzureBlobProviderConfig {
+            account_name: "devstoreaccount1".into(),
+            account_key: AZURITE_KEY.into(),
+            container_name: "portabase".into(),
+            auth_mode: Some("accountKey".into()),
+            connection_string: CONNECTION_STRING.into(),
+            endpoint_url: Some("http://localhost:10000".into()),
+        };
+        let r = cfg.resolve().unwrap();
+        assert_eq!(r.account_name, "devstoreaccount1");
+        assert_eq!(r.account_key, AZURITE_KEY);
+        assert_eq!(r.blob_endpoint, "http://localhost:10000/devstoreaccount1");
+    }
+
+    #[test]
+    fn resolve_implicit_connection_string() {
+        let cfg = AzureBlobProviderConfig {
+            account_name: String::new(),
+            account_key: String::new(),
+            container_name: "portabase".into(),
+            auth_mode: None,
+            connection_string: CONNECTION_STRING.into(),
+            endpoint_url: None,
+        };
+        let r = cfg.resolve().unwrap();
+        assert_eq!(r.blob_endpoint, "http://localhost:10000/devstoreaccount1");
+    }
+
+    #[test]
+    fn resolve_account_key_default_endpoint() {
+        let cfg = AzureBlobProviderConfig {
+            account_name: "myaccount".into(),
+            account_key: AZURITE_KEY.into(),
+            container_name: "portabase".into(),
+            auth_mode: Some("accountKey".into()),
+            connection_string: String::new(),
+            endpoint_url: None,
+        };
+        let r = cfg.resolve().unwrap();
+        assert_eq!(r.blob_endpoint, "https://myaccount.blob.core.windows.net");
+    }
+
+    #[test]
+    fn ensure_account_keeps_host_style_endpoint() {
+        let got =
+            ensure_account_in_endpoint("https://myaccount.blob.core.windows.net", "myaccount");
+        assert_eq!(got, "https://myaccount.blob.core.windows.net");
+    }
+}
+
+#[tokio::test]
+async fn upload_stream_multi_block_roundtrip() {
+    init_tracing_for_test();
+    use crate::services::storage::providers::azure_blob::helpers::upload_stream_to_azure;
+    use futures::stream;
+
+    let (_container, resolved) = start_azurite().await;
+    let container = "portabase";
+    let blob = "backups/multi.bin";
+
+    let container_url =
+        build_account_sas_container_url(&resolved, container, "b", "c", "cw").unwrap();
+    azure_storage_blob::clients::BlobContainerClient::new(container_url, None, None)
+        .unwrap()
+        .create(None)
+        .await
+        .unwrap();
+
+    let data = vec![7u8; 10 * 1024];
+    let chunks: Vec<Result<Bytes, std::io::Error>> = data
+        .chunks(1024)
+        .map(|c| Ok(Bytes::copy_from_slice(c)))
+        .collect();
+    let body = Box::pin(stream::iter(chunks));
+
+    upload_stream_to_azure(&resolved, container, blob, body, 4 * 1024)
+        .await
+        .unwrap();
+
+    let read_url = build_sas_url(&resolved, container, blob, SasResource::Blob, "r").unwrap();
+    let got = reqwest::get(read_url).await.unwrap().bytes().await.unwrap();
+    assert_eq!(got.as_ref(), data.as_slice());
+}

src/tests/storage/google_cloud_storage.rs

@@ -0,0 +1,99 @@
+use crate::services::storage::providers::google_cloud_storage::helpers::{
+    StreamSource, upload_with_client,
+};
+use crate::tests::init_tracing_for_test;
+
+use bytes::Bytes;
+use futures::stream;
+use google_cloud_storage::client::Storage;
+use testcontainers::core::{IntoContainerPort, WaitFor};
+use testcontainers::runners::AsyncRunner;
+use testcontainers::{GenericImage, ImageExt};
+
+const BUCKET: &str = "portabase";
+
+async fn start_fake_gcs() -> (testcontainers::ContainerAsync<GenericImage>, String) {
+    // Natural random host port (no port-80 pin). The provider forces a single-shot
+    // upload for custom endpoints, which issues one request to this endpoint and never
+    // follows a server-built `Location` — so it works on any port, unlike the resumable
+    // path that the SDK's Host-header port-drop bug breaks on non-443 ports.
+    let container = GenericImage::new("fsouza/fake-gcs-server", "latest")
+        .with_exposed_port(4443.tcp())
+        .with_wait_for(WaitFor::message_on_stderr("server started at"))
+        .with_cmd(["-scheme", "http", "-backend", "memory", "-port", "4443"])
+        .start()
+        .await
+        .unwrap();
+
+    let host = container.get_host().await.unwrap().to_string();
+    let port = container.get_host_port_ipv4(4443).await.unwrap();
+    let endpoint = format!("http://{host}:{port}");
+    (container, endpoint)
+}
+
+async fn anon_client(endpoint: &str) -> Storage {
+    let creds = google_cloud_auth::credentials::anonymous::Builder::new().build();
+    Storage::builder()
+        .with_credentials(creds)
+        .with_endpoint(endpoint.to_string())
+        .build()
+        .await
+        .unwrap()
+}
+
+async fn create_bucket(endpoint: &str) {
+    let url = format!("{endpoint}/storage/v1/b?project=test-project");
+    let res = reqwest::Client::new()
+        .post(&url)
+        .json(&serde_json::json!({ "name": BUCKET }))
+        .send()
+        .await
+        .unwrap();
+    assert!(
+        res.status().is_success(),
+        "bucket create failed: {}",
+        res.status()
+    );
+}
+
+#[tokio::test]
+async fn upload_stream_roundtrip_against_fake_gcs() {
+    init_tracing_for_test();
+    let (_container, endpoint) = start_fake_gcs().await;
+    create_bucket(&endpoint).await;
+
+    let object = "backups/multi.bin";
+
+    // 10 KiB fed as 1 KiB chunks -> multi-chunk streaming path.
+    let data = vec![7u8; 10 * 1024];
+    let chunks: Vec<Result<Bytes, std::io::Error>> = data
+        .chunks(1024)
+        .map(|c| Ok(Bytes::copy_from_slice(c)))
+        .collect();
+    let source = StreamSource::from_stream(Box::pin(stream::iter(chunks)), data.len() as u64);
+
+    let client = anon_client(&endpoint).await;
+
+    // force_single_shot = true (custom endpoint). Guard with a timeout so a regression
+    // into the resumable path (which would hang forever on this non-443 port) fails the
+    // test instead of stalling it.
+    tokio::time::timeout(
+        std::time::Duration::from_secs(60),
+        upload_with_client(&client, BUCKET, object, source, true),
+    )
+    .await
+    .expect("upload hung (regressed to resumable path on a non-443 endpoint?)")
+    .unwrap();
+
+    let read_url = format!(
+        "{endpoint}/storage/v1/b/{BUCKET}/o/{}?alt=media",
+        object.replace('/', "%2F")
+    );
+    let got = reqwest::get(&read_url)
+        .await
+        .unwrap()
+        .bytes()
+        .await
+        .unwrap();
+    assert_eq!(got.as_ref(), data.as_slice());
+}

src/tests/storage/mod.rs

@@ -0,0 +1,2 @@
+mod azure_blob;
+mod google_cloud_storage;