asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

garage-bootstrap: let asxpio write to the public bucket
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
Details

Browse source 
asxpio's admin is getting a page for uploading files meant for public
use. They belong in the public bucket, which so far only the
public-upload key could write to. Grant asxpio's existing key put and
delete there instead of handing the app a second set of credentials.

Write-only is enough: the app keeps its own index of what it uploaded
and never reads the objects back.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 05:46:48 +04:00
commit 25ad601754
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -32,7 +32,8 @@ Garage answers no anonymous S3 request. `public` is marked as a website
instead, and Traefik sends unsigned GET/HEAD of
`https://s3.asxp.io/public/<key>` to Garage's web endpoint. Anyone who knows a
key can read it; nobody can list the bucket. Uploading needs the uploader key
(see `SECRETS.md`).
(see `SECRETS.md`) or asxpio's key, which may put and delete there for its
admin's file uploads.
## Looking inside