minio-init: add a public bucket with a put-only uploader

There was no way to share a file by link: both buckets are private and
the bootstrap forces anonymous access off on every run.

Add a bucket named public whose objects anyone can GET by key, with no
anonymous listing or writes, and an optional user that may only put and
delete there, so a leaked uploader key reads nothing and reaches no
other bucket.

Assisted-by: Claude:fable-5-2

init/minio-bootstrap.sh

@@ -58,6 +58,48 @@ EOF
     || mc admin policy update local "${name}" "/tmp/${name}.json"
 }
 
+# World-readable by object key; no anonymous listing or writes.
+ensure_public_bucket() {
+  bucket="$1"
+  if ! mc ls "local/${bucket}" >/dev/null 2>&1; then
+    mc mb "local/${bucket}"
+  fi
+  cat > "/tmp/${bucket}-anonymous.json" <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Principal": {"AWS": ["*"]},
+      "Action": ["s3:GetObject"],
+      "Resource": ["arn:aws:s3:::${bucket}/*"]
+    }
+  ]
+}
+EOF
+  mc anonymous set-json "/tmp/${bucket}-anonymous.json" "local/${bucket}" >/dev/null
+}
+
+# Put and delete only: the holder can publish and retract, not read or list.
+write_upload_policy() {
+  name="$1"
+  bucket="$2"
+  cat > "/tmp/${name}.json" <<EOF
+{
+  "Version": "2012-10-17",
+  "Statement": [
+    {
+      "Effect": "Allow",
+      "Action": ["s3:PutObject", "s3:DeleteObject"],
+      "Resource": ["arn:aws:s3:::${bucket}/*"]
+    }
+  ]
+}
+EOF
+  mc admin policy create local "${name}" "/tmp/${name}.json" 2>/dev/null \
+    || mc admin policy update local "${name}" "/tmp/${name}.json"
+}
+
 # $3: one or more policy names, space-separated.
 ensure_user() {
   access="$1"
@@ -89,6 +131,17 @@ else
   echo "minio-init: BINGO_S3_* unset, skipping bingo user"
 fi
 
+# Files shared by link: https://s3.asxp.io/public/<key>. Everything in this
+# bucket is readable by anyone who knows the key.
+ensure_public_bucket "public"
+write_upload_policy  "public-upload" "public"
+
+if [ -n "${PUBLIC_S3_ACCESS_KEY:-}" ] && [ -n "${PUBLIC_S3_SECRET_KEY:-}" ]; then
+  ensure_user   "${PUBLIC_S3_ACCESS_KEY}" "${PUBLIC_S3_SECRET_KEY}" "public-upload"
+else
+  echo "minio-init: PUBLIC_S3_* unset, skipping public uploader"
+fi
+
 # Leftover from before the photos had their own bucket.
 mc admin policy remove local "asxpio-invoices-bingo-ro" >/dev/null 2>&1 || true