Nightly DigitalOcean Droplet Snapshot Backups by Tag

Give every droplet that opts in through a tag a nightly, dated snapshot without writing a single doctl script. This blueprint lists the whole DigitalOcean fleet on a schedule, walks it with bounded concurrency, snapshots only the machines tagged auto-backup, and posts a Slack summary. Because each snapshot is its own task run inside a ForEach, one machine failing to snapshot never cancels backups for the rest of the fleet, and the errors block makes a silent backup failure impossible.

How it works

1. list_droplets (io.kestra.plugin.digitalocean.droplet.List) fetches every droplet on the account with fetchType: FETCH, so each row carries the droplet's id, name, and tags straight from the DigitalOcean API.
2. snapshot_tagged_droplets (io.kestra.plugin.core.flow.ForEach) iterates over those rows with a concurrencyLimit of 2 to stay well inside DigitalOcean API rate limits.
3. Inside the loop, check_backup_tag (io.kestra.plugin.core.flow.If) inspects the droplet's tag list, defaulting to an empty list for untagged machines, and only proceeds when auto-backup is present.
4. snapshot_droplet (io.kestra.plugin.digitalocean.droplet.Action) fires the SNAPSHOT action with a name like auto-web-01-2026-08-17, so retention tooling can sort and expire snapshots by date.
5. notify posts a Slack summary with the total number of droplets evaluated, and the errors block posts a separate alert whenever the sweep fails.

Every DigitalOcean task carries the API token from the DIGITALOCEAN_TOKEN secret directly.

What you get

• Opt-in backups controlled by a droplet tag instead of a hardcoded server list that goes stale.
• Dated snapshot names that make retention and restore decisions obvious at a glance.
• Per-droplet isolation: a snapshot API error on one machine leaves every other machine's backup untouched.
• A nightly Slack heartbeat proving the sweep ran, plus a loud alert when it did not.

Who it's for

• Infrastructure teams running fleets of droplets who need a backup policy that new machines join by adding one tag.
• Agencies and platform teams managing many small workloads on DigitalOcean where per-droplet backup plans are too expensive or too coarse.
• Anyone who wants snapshot automation with an audit trail instead of a cron job on a bastion host.

Why orchestrate this with Kestra

DigitalOcean's built-in backups run on a fixed weekly cadence per droplet and cannot be filtered by tag, named by date, coordinated with rate limits, or reported to Slack. Kestra composes the same public API into a policy: List discovers the fleet dynamically, ForEach with a concurrency limit paces the calls, If applies the tag rule, and Kestra's execution history shows exactly which droplet was snapshotted when, with retries and alerting handled by the platform instead of shell glue.

Prerequisites

• A DigitalOcean personal access token with read scope for droplets and write scope for droplet actions.
• Droplets you want covered tagged with auto-backup.
• A Slack incoming webhook for the summary and failure alerts.

Secrets

• DIGITALOCEAN_TOKEN: DigitalOcean personal access token.
• SLACK_WEBHOOK_URL: Slack incoming webhook URL.

Quick start

1. Add the two secrets above to your Kestra namespace.
2. Tag the droplets that need backups with auto-backup in the DigitalOcean console or via doctl.
3. Execute the flow once manually and confirm the snapshots appear under Images in the console.
4. Set disabled: false on the nightly trigger to put the sweep on schedule.

How to extend

• Change the tag or add several tags with different schedules, for example backup-hourly and backup-nightly, by duplicating the flow with different If conditions and cron expressions.
• Add a retention step that lists snapshots prefixed auto- and deletes the ones older than your window.
• Power off databases or quiesce applications before the snapshot with droplet.Action and POWER_OFF, then power back on after, for crash-consistent images of write-heavy machines.
• Push the sweep result into a monitoring system instead of Slack by swapping the notification task.

Links

• DigitalOcean plugin documentation
• Kestra ForEach task