asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions

garage-bootstrap: let asxpio write to the public bucket
All checks were successful
Deploy storage stack / deploy (push) Successful in 19s
Details

Browse source 
asxpio's admin is getting a page for uploading files meant for public
use. They belong in the public bucket, which so far only the
public-upload key could write to. Grant asxpio's existing key put and
delete there instead of handing the app a second set of credentials.

Write-only is enough: the app keeps its own index of what it uploaded
and never reads the objects back.

Assisted-by: Claude:fable-5-2
This commit is contained in:
Sergei Poljanski 2026-11-12 05:46:48 +04:00
commit 25ad601754
Signed by: asxpi
GPG key ID: 4F8851660FA4121B
2 changed files with 4 additions and 1 deletions
Download patch file Download diff file Expand all files Collapse all files

3
README.md
View file

@ -32,7 +32,8 @@ Garage answers no anonymous S3 request. `public` is marked as a website
instead, and Traefik sends unsigned GET/HEAD of instead, and Traefik sends unsigned GET/HEAD of
`https://s3.asxp.io/public/<key>` to Garage's web endpoint. Anyone who knows a `https://s3.asxp.io/public/<key>` to Garage's web endpoint. Anyone who knows a
key can read it; nobody can list the bucket. Uploading needs the uploader key key can read it; nobody can list the bucket. Uploading needs the uploader key
(see `SECRETS.md`). (see `SECRETS.md`) or asxpio's key, which may put and delete there for its
admin's file uploads.
## Looking inside ## Looking inside

2
init/garage-bootstrap.sh
View file

@ -84,6 +84,8 @@ g bucket website --allow public >/dev/null
asxpio="$(ensure_key asxpio "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}")" asxpio="$(ensure_key asxpio "${ASXPIO_S3_ACCESS_KEY}" "${ASXPIO_S3_SECRET_KEY}")"
grant "asxpio-invoices" "$asxpio" rw grant "asxpio-invoices" "$asxpio" rw
grant "datacenterbingo-photos" "$asxpio" rw grant "datacenterbingo-photos" "$asxpio" rw
# asxpio's admin publishes and retracts files; it keeps its own index.
grant "public" "$asxpio" wo
if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then if [ -n "${BINGO_S3_ACCESS_KEY:-}" ] && [ -n "${BINGO_S3_SECRET_KEY:-}" ]; then
bingo="$(ensure_key bingo "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}")" bingo="$(ensure_key bingo "${BINGO_S3_ACCESS_KEY}" "${BINGO_S3_SECRET_KEY}")"