MinIO

Run MinIO yourself when the files must stay on hardware you control. CloudFile connects to it over the internet like any other S3 service.

Before you start

• A MinIO server reachable from the internet over https, with a certificate from a public CA such as Let’s Encrypt. Self-signed certificates and private addresses (LAN, VPN, localhost) don’t work.
• The MinIO client, mc, with an alias for your server, for example:

mc alias set myminio https://minio.example.com ADMIN_ACCESS_KEY ADMIN_SECRET_KEY

1. Create the bucket

mc mb myminio/my-bucket

Don’t add --with-lock, and leave versioning off. Object locking stops SFTP users from deleting or replacing files, and versioning keeps deleted files on disk. MinIO buckets are private unless you set an anonymous policy, so there’s nothing else to do.

2. Create an access key

Create a policy for the bucket, then a user with that policy.

1. Save this policy as cloudfile.json (replace my-bucket):

{
  "Version": "2012-10-17",
  "Statement": [
    {
      "Effect": "Allow",
      "Action": "s3:ListBucket",
      "Resource": "arn:aws:s3:::my-bucket"
    },
    {
      "Effect": "Allow",
      "Action": ["s3:GetObject", "s3:PutObject", "s3:DeleteObject", "s3:AbortMultipartUpload"],
      "Resource": "arn:aws:s3:::my-bucket/*"
    }
  ]
}

2. Create the policy, the user and attach one to the other:

mc admin policy create myminio cloudfile cloudfile.json
mc admin user add myminio cloudfile 'A-LONG-RANDOM-SECRET'
mc admin policy attach myminio cloudfile --user cloudfile

The user name (cloudfile) is the access key ID, and the password is the secret access key. Use a long random secret, for example from openssl rand -base64 30.

3. Connect it

In CloudFile, go to Storage → Add bucket and choose MinIO:

Keep Path-style URLs on unless you’ve set up MINIO_DOMAIN with wildcard DNS for virtual-hosted buckets. Use the S3 API port, not the web console’s port.

Click Test connection, then Save. To use the bucket, open a server and pick it under Settings → Storage.

Troubleshooting

• Endpoint failed: Storage endpoint must use https. Put MinIO behind TLS with a public certificate, either on MinIO itself or on a reverse proxy in front of it.
• Endpoint failed: Storage endpoint must resolve to a public address. The hostname points to a private or local IP. CloudFile only connects to public addresses, so expose MinIO on a public IP or hostname.
• Writing a test file failed with a certificate or connection error. The certificate is self-signed or doesn’t match the hostname, the endpoint uses the console port, or a firewall blocks the API port.
• Writing a test file failed with a region error. The server has a region set. Use the value of MINIO_SITE_REGION.
• Writing a test file failed: Access Denied. The policy isn’t attached to the user or names a different bucket. Check with mc admin user info myminio cloudfile.

See Your own bucket for how files are laid out in the bucket.