asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

minio-init: add a public bucket with a put-only uploader

Browse source 
There was no way to share a file by link: both buckets are private and
the bootstrap forces anonymous access off on every run.

Add a bucket named public whose objects anyone can GET by key, with no
anonymous listing or writes, and an optional user that may only put and
delete there, so a leaked uploader key reads nothing and reaches no
other bucket.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-11 03:24:59 +04:00
commit 10c620e796
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
4 changed files with 76 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

6
.forgejo/workflows/deploy.yaml
View file

@ -38,11 +38,13 @@ jobs:
BINGO_DB_PASSWORD: ${{ secrets.BINGO_DB_PASSWORD }}
BINGO_S3_ACCESS_KEY: ${{ secrets.BINGO_S3_ACCESS_KEY }}
BINGO_S3_SECRET_KEY: ${{ secrets.BINGO_S3_SECRET_KEY }}
PUBLIC_S3_ACCESS_KEY: ${{ secrets.PUBLIC_S3_ACCESS_KEY }}
PUBLIC_S3_SECRET_KEY: ${{ secrets.PUBLIC_S3_SECRET_KEY }}
with:
host: ${{ secrets.DEPLOY_IP }}
username: ${{ secrets.DEPLOY_USER }}
key: ${{ secrets.DEPLOY_SSH_KEY }}
envs: POSTGRES_PASSWORD,MINIO_ROOT_USER,MINIO_ROOT_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY,BINGO_DB_PASSWORD,BINGO_S3_ACCESS_KEY,BINGO_S3_SECRET_KEY
envs: POSTGRES_PASSWORD,MINIO_ROOT_USER,MINIO_ROOT_PASSWORD,ASXPIO_DB_PASSWORD,ASXPIO_S3_ACCESS_KEY,ASXPIO_S3_SECRET_KEY,BINGO_DB_PASSWORD,BINGO_S3_ACCESS_KEY,BINGO_S3_SECRET_KEY,PUBLIC_S3_ACCESS_KEY,PUBLIC_S3_SECRET_KEY
script_stop: true
script: |
umask 077
@ -57,6 +59,8 @@ jobs:
BINGO_DB_PASSWORD=${BINGO_DB_PASSWORD}
BINGO_S3_ACCESS_KEY=${BINGO_S3_ACCESS_KEY}
BINGO_S3_SECRET_KEY=${BINGO_S3_SECRET_KEY}
PUBLIC_S3_ACCESS_KEY=${PUBLIC_S3_ACCESS_KEY}
PUBLIC_S3_SECRET_KEY=${PUBLIC_S3_SECRET_KEY}
EOF
chmod 600 /opt/storage/.env
chmod +x /opt/storage/init/postgres-init.sh /opt/storage/init/minio-bootstrap.sh