Automate encrypted database backups to S3

[diarmuidbourke]

Enable in heroku.
Store outside Amazon ecosystem.

[matrixise]

Heroku backups are already configured and can be managed with existing Task commands:

• task heroku:database:backups - View existing backups
• task heroku:database:run-backup - Create a new backup

Proposed solution for automated encrypted backups to S3:

1. Create a script/workflow that:

   • Downloads the latest backup from Heroku (heroku pg:backups:download)
   • Uploads to a dedicated S3 bucket with encryption enabled (SSE-S3 or SSE-KMS)
   • Optionally add GPG encryption before upload for extra security

2. Automate with:

   • Heroku Scheduler for periodic backups
   • Or GitHub Actions workflow triggered on schedule

3. Add retention policy to manage old backups

If someone wants to pick this up and create a branch, that would be great!