asxpio's admin is getting a page for uploading files meant for public
use. They belong in the public bucket, which so far only the
public-upload key could write to. Grant asxpio's existing key put and
delete there instead of handing the app a second set of credentials.
Write-only is enough: the app keeps its own index of what it uploaded
and never reads the objects back.
Assisted-by: Claude:fable-5-2
Garage serves all three buckets and both apps, and a last comparison
found nothing in MinIO that Garage lacks. Drop the MinIO service, its
bootstrap and its root credentials from the deploy, and let compose
remove the leftover containers.
The storage_minio_data volume is left on the host. All images can be
pulled again, so the deploy goes back to failing on a pull error.
Document Garage in the README and SECRETS, including the key format and
how the existing secrets map to it, and swap the MinIO client in the
flake for awscli and rclone.
Assisted-by: Claude:fable-5-2
MinIO is abandoned upstream and its images are gone from the registries,
so the object store cannot be rebuilt or updated. Garage takes its
place.
This is the first step: Garage runs as one node next to MinIO, with the
same three buckets and one key per app, and is not routed yet. MinIO
keeps serving s3.asxp.io and is no longer bootstrapped, so its users
stay as they are until the data is copied and the apps are switched.
Garage only accepts keys in its own format. The bootstrap hashes the
existing secrets into that format, as the apps' deploys will, so no
secret has to change for the move; a secret already in Garage's format
is used as it is.
Garage has no anonymous S3 access. The public bucket is marked as a
website instead, to be served through Garage's web endpoint.
Assisted-by: Claude:fable-5-2
There was no way to share a file by link: both buckets are private and
the bootstrap forces anonymous access off on every run.
Add a bucket named public whose objects anyone can GET by key, with no
anonymous listing or writes, and an optional user that may only put and
delete there, so a leaked uploader key reads nothing and reaches no
other bucket.
Assisted-by: Claude:fable-5-2
asxpio's migration 017 adds bingo_monitor_targets, _samples and
_buckets for datacenterbingo's status page. The migration grants them
itself; list them here too so a fresh install gets the same grants.
Assisted-by: Claude:opus-5-5
All photos are in datacenterbingo-photos and both apps use it, so stop
mirroring from asxpio-invoices/bingo/ and take away the bingo user's
read access there.
Assisted-by: Claude:opus-5
The minio/mc image has no grep, so the emptiness check always failed and
the photos were never mirrored into datacenterbingo-photos.
Assisted-by: Claude:opus-5
The datacenter bingo photos sat under bingo/ in asxpio-invoices, next to
the invoice PDFs, guarded only by a prefix policy. Move them to a
datacenterbingo-photos bucket: asxpio's user gets read-write for the
admin's uploads, the bingo user read-only on the whole bucket.
Existing objects are mirrored over with their keys unchanged, so the
database rows stay valid. Both users keep their old access until the
apps are switched and the old prefix is removed.
Assisted-by: Claude:opus-5
The public bingo site is moving out of the asxpio container and only
needs to read the bingo tables and the bingo/ photos. Give it a role
limited to SELECT on those two tables (with read-only transactions by
default) and a MinIO user limited to GetObject under
asxpio-invoices/bingo/, instead of reusing asxpio's read-write
credentials.
Both steps are skipped while the BINGO_* secrets are unset, so this
deploys safely before they exist. Tables missing on a fresh install
are granted on the next deploy.
Assisted-by: Claude:opus-5
