asxpi/storage
1
0
Fork 0
Code Issues Pull requests Wiki Activity Actions
No description
12 commits 1 branch 0 tags 105 KiB
  • Shell 86.1%
  • Nix 13.9%
Find a file
Sergei Poljanski bdfc028ca1
All checks were successful
Deploy storage stack / deploy (push) Successful in 20s
Details
Route s3.asxp.io to Garage 
The data is copied and verified and both apps sign with their Garage
keys, so send s3.asxp.io to Garage's S3 API. MinIO loses its route and
stays up, unrouted, as the way back.

Garage answers no anonymous S3 request. Unsigned GET and HEAD of
/public/<key> go to its web endpoint instead, with the Host header the
endpoint picks the bucket by, so the links handed out so far keep
working. Signed requests for that bucket still reach the S3 API.

Assisted-by: Claude:fable-5-2
2026-11-11 03:44:37 +04:00
.forgejo/workflows Add Garage beside MinIO 2026-11-11 03:41:03 +04:00
init Add Garage beside MinIO 2026-11-11 03:41:03 +04:00
.env.example Provision read-only credentials for datacenterbingo 2026-10-12 03:47:57 +04:00
.gitignore Initial commit 2026-05-26 17:13:14 +03:00
docker-compose.yml Route s3.asxp.io to Garage 2026-11-11 03:44:37 +04:00
flake.lock Initial commit 2026-05-26 17:13:14 +03:00
flake.nix Initial commit 2026-05-26 17:13:14 +03:00
garage.toml Add Garage beside MinIO 2026-11-11 03:41:03 +04:00
README.md Initial commit 2026-05-26 17:13:14 +03:00
SECRETS.md minio-init: add a public bucket with a put-only uploader 2026-11-11 03:24:59 +04:00

README.md

storage

Postgres + MinIO for asxp.io and any future small services that need a database or object storage. Single-host, no clustering. Deploys via Forgejo Actions to the same box that runs the apps.

What's here

  • docker-compose.yml — postgres, minio, and one-shot init containers.
  • init/postgres-init.sh — idempotent role/DB bootstrap.
  • init/minio-bootstrap.sh — idempotent bucket + per-app service account.
  • .forgejo/workflows/deploy.yaml — pushes compose + .env to the prod host and runs docker compose up -d.

Networking

Two Docker networks:

  • storage — internal-only; apps join this as an external network to reach postgres:5432 and minio:9000.
  • traefik — existing reverse-proxy network. Only MinIO joins it, to expose the S3 API at https://s3.asxp.io.

The MinIO console (:9001) is not exposed externally. To use it, SSH-port-forward:

ssh -L 9001:storage-minio:9001 deploy@prod
# then open http://localhost:9001

Adding a new app

  1. Pick an app name, e.g. foo.
  2. Pick a DB password, S3 access key, S3 secret key for it (any random hex).
  3. Add Forgejo secrets FOO_DB_PASSWORD, FOO_S3_ACCESS_KEY, FOO_S3_SECRET_KEY to this repo and to the foo repo.
  4. Extend init/postgres-init.sh with ensure_role "foo" ... and ensure_db "foo" "foo".
  5. Extend init/minio-bootstrap.sh with ensure_bucket "foo-...", write_policy "foo-...-rw" "foo-...", ensure_user ... "foo-...-rw".
  6. Pass the new envs through in docker-compose.yml and the deploy workflow.
  7. Push.

State and backups

Two named Docker volumes are stateful:

  • pg_data (Postgres data dir) — /var/lib/docker/volumes/storage_pg_data/_data
  • minio_data (S3 object bytes) — /var/lib/docker/volumes/storage_minio_data/_data

Server-level backup covers both. If you ever move off whole-server backup, the minimum is pg_dumpall for Postgres and mc mirror for MinIO.

Secrets

See SECRETS.md for the full list of Forgejo secrets this repo needs. Apps that consume storage (asxpio, future) also need the per-app credentials added on their repo so they can connect.