tired kubernetes sre smiling - cartoon filter applied

dusty.ninja

Thread of 3 posts

Tried to get #Litestream working again with #gotosocial but I keep running into 403 errors using #DigitalOcean Spaces for S3. the error is "api error SignatureDoesNotMatch: The request signature we calculated does not match the signature you provided. Check your key and signing method".

This kept repeating until the .sqlite.db-litestream directory filled my disk (about 10x the size of actual DB). Still need to do sqlite backups the old fashioned way: make compressed copy and upload with s3cmd.

The #litestream issue I made generated a number of responses, and there was an option that changed from not required to required. (I'll spare you the explanation here since it's all in the above issue.) 😵‍💫

Anyway, in this journey, I also out of desperation asked #ChatGPT, and of course, it gave me nonsense to try. It even had me change the syntax of YAML from a single replica statement to an array of replicas with one entry. I later read that this was old ways of doing things in the 0.3.x series. So now I'll need to go back and fix before the old way is completely deprecated. 😑

I was so irritated I told ChatGPT the actual solution and then it tried to pretend that it was giving me the solution? 😡

ChatGPT also for some reason decided to use an AWS region (us-east-1) instead of Digital Ocean Spaces region(sfo3).

 Conversation between myself and ChatGPT. Me: I found the problem. the new v0.5.3 release requires non-aws S3 to include the option sign-payload: true. for some reason this is no longer default as of v0.5.3, it was default through version v0.5.2. ChatGPT: Nice catch — that fits the symptom perfectly: SigV4 SignatureDoesNotMatch during multipart UploadPart is exactly what you see when the server expects a signed payload but the client is using UNSIGNED-PAYLOAD (or otherwise not including the payload hash in the signature). For anyone else hitting this on Litestream v0.5.3 + DigitalOcean Spaces (or other S3-compatible), the fix is to set sign-payload: true on the replica. example Yaml: dbs: - path: /gotosocial/sqlite.db replicas: - type: s3 bucket: dustyninja-backup path: db endpoint: https://sfo3.digitaloceanspaces.com region: us-east-1 sign-payload: true access-key-id: ${LITESTREAM_ACCESS_KEY_ID} secret-access-key: ${LITESTREAM_SECRET_ACCESS_KEY}